Are you saying you do not have the certificate of authenticity?
Do you have the key?
Is the key only in your possession, or can someone else also have the key with or without your knowledge?
I mean when you say he threw away the box, did he throw away the key with it?
Because if someone get their hands on that key and have a copy of an XP CD, they can install it and use that key! That would not be good for the buyer.