How to prove legitimacy or that my coin was not used in a recent illicit deal?
Administratively, there should be plenty of evidence that Bob was working a legitimate job.


If the web firm is a US company and Bob a US worker, then the company is required to file a form 1099-MISC.  Yes ... even if they paid him in non-USD currency.
Some time in that seven-month period, Bob should have paid his quarterly    taxes.  That adds to the legitimacy of his income.
There must be some kind of timekeeping and invoicing process between Bob and the web company, along with specifications, emails, and other evidence of a working relationship.
Bob can point to the stuff he built. (I know from experience that this isn't always possible.  I have worked on a lot of internal projects that people outside a company never have access to.)
If the web company bought their bitcoins on open exchanges, then there is an associated bank account and a bunch of regulatory machinery that has already kicked in at some point.  The company is already being monitored under the usual rules for currency exchanges.


There is a technical side of this too.  Because the entire bitcoin ledger is public knowledge, it should be very clear that Bob has been saving his bitcoins for the past several months.  That is probably not typical behavior for a money launderer.  If, on the other hand, it is clear Bob has been using a mixing service to receive his Bitcoins he may have a problem.

Ultimately all money is fungible.  As you've already intuited, this problem isn't really much different from if Bob was taking his pay in USD instead of Bitcoin.