he customizes his mining software to not ever increase the difficulty, even if it's mining hundreds of blocks per second; block timestamps are simply faked in order to make it seem they were generated at ~10 minutes interval.
When the fake blockchain is longer then the real one (currently ~300000 blocks), he starts broadcasting it; it appears to conform to all rules, and it's longer than the current one
As pointed out the "longest chain" is the one with the highest sum of difficulty. However even if that wasn't the case the blocks would be invalid. The timestamp of the genesis block is fixed at 01/03/2009. To avoid a difficulty increase no more than 144 blocks can be mined per day. To mine a chain longer than the current chain would require 2083 days of faked timestamps. That would make the timestamp of the last block 09/18/2014 or almost 4 months into the future. Blocks which deviate from the network median time by more than 2 hours are invalid, in other words they "don't conform to all the rules".