If the primary ethical concern here is, "is it OK that thieves are punished", then I think the answer for almost everyone is "yes, that's OK". If he really is attempting to steal a computer then you should rest easy that you have no general responsibility to avoid actions that result in him being fired for that. All the complexity lies in whether and when it's OK for suspected thieves to be reported: if he's not stealing then he's almost certainly going to survive scrutiny, but there is some harm done by false suspicions flying around.
I know that Apple hasn't made that type of imac for about three years.
Based on this, I am certain that this is not a new computer.
It doesn't really matter whether it's new or old, that's just what happened to make you suspicious. And it doesn't matter whether you're certain or not, because it's not your job to decide whether to fire him.
Therefore, if you're going to report it at all then you should merely report what it is about the machine that makes you think it's not the one he used the company credit card to purchase. Don't say "it's not the same machine", say "I think it's an old model, and I am telling this so you can look into it if that troubles you". Report this to the person who's responsible for deciding whether this is worth further investigation, or to someone else who can report it them: whatever structure your company has in place. If you need more detail about your company's arrangements consult staff handbook, your line manager, etc.
You may be able to report anonymously if you're concerned about retribution (in which case, you also need to figure out how without asking anyone). A lot of people are very hostile to informants, even among those who directly benefit from the information. There's probably no need in this case for your testimony of what you've witnessed, so a completely anonymous tip-off might do the job. Either it's the right computer or it isn't, and that's established by comparing the object to the receipt, not by what you've seen or your knowledge of Macs. Frequently a company will have a not-really-anonymous procedure for reporting suspicions of wrongdoing, where the person you report to promises to keep your name out of it, but they know who you are. In that case you should also consider whether you trust that person.
As to whether to report it at all: this really depends whether you feel that part of your job is to protect the company's property in general as opposed to only following direct orders. This depends on company culture. There are companies where everybody's either thieving or turning a blind eye to it, and there are companies where taking a computer is the kind of thing employees would be willing to help prevent. I'm used to the latter, but not every company inspires much desire in its employees to look out for it. Think about what kind of company you're in, and where on the spectrum you want to be, and act accordingly. Ethically the issues are whether you feel a responsibility to your employer, and whether you feel a responsibility to your colleague (or if not personally to that colleague, a general responsibility not to make accusations). And if both, which outweighs the other. Very few people have sufficiently simple responsibilities either to say, "I would always report suspected theft no matter the cost", or "I would never report suspected theft under any circumstances", and so you need to make your ethical consideration on the details of the case.
One possible alternative to reporting it, is to take the matter into your own hands by challenging your colleague with what you've observed (some of the answers offer indirect ways of doing this rather than a direct accusation). This might be enough to prompt him to bring the real machine in. However, I don't really recommend this firstly because it opens you to retribution, secondly because it involves making a threat to report him, and thirdly because it involves offering to keep the matter you yourself provided it's settled to your own satisfaction. Any of those might be justifiable to give your colleague a chance to be honest, but it puts you in rather a difficult position.
There may well be no need to do anything even if you do feel a general responsibility to the company rather than your colleague. Someone told him to bring it in. They are presumably already on the case, and will be taking steps to figure out for themselves whether their instruction was followed or not. You might reasonably decide that they don't need your help to do their job, and leave it to them to do whatever checks they feel are appropriate. They have eyes, they can see what you can see, but they have more information than you: they know what he claimed to have bought. So, you might reasonably say there's a difference between this case, where someone else is already dealing with it, and a different case where you caught him loading a truck out of the company warehouse and you're the only one who knows he did it.
Whatever you decide, you should not investigate this yourself, or try to chase up whether the computer he bought was supposed to be new or old. What you observe with your own eyes is potentially yours to report. His expense receipts are not your business even if he really is stealing. For that matter, even if the machine isn't the right one, it's not your business why that is. For all you know he has confessed confidentially, the books have been balanced, and the matter is already dealt with. In which case even if you're correct, you'll report it and never hear anything more about it.
Finally, it's just about conceivable, depending on jurisdiction and the details of the case, that you could be committing a criminal offence of "accessory after the fact" by choosing not to report it. I'm not saying you certainly would, just that it's a possibility. In your defence, the fact that you don't know what computer he's supposed to have bought means you don't actually know he's done anything wrong. And, while the law is not the same as ethics, you still in my opinion have some right to include in your consideration the weight of the consequences for yourself of what you do. You should at least think about whether you would be fired if, somewhere down the line, this guy gets found out and fired and somebody figures out that you knew what you know and chose not to report it. This is just the flip side of considering the retribution you might face if you do inform.