If private key was sold together with the account yes its possible to sign a message from an old address and the only way to prove if its sold is "if" the escrow will say anything about the trade and "if" escrow was used. But I don't think account was sold. That loan amount to too small to ruin the account. he could have asked for a higher amount if he plans to scam.