While checking the seclogs its found that he never changed pass during that time, so how the hell he sold the account ?
Please show those logs and there is a chance that person does not changes passwords when selling accounts because if people change passwords then they are asked for signed messages and hence they fail to do that.