First,  am always happy when scam methods are exposed. It helps others who are vulnerable to be on their toes.  But then to the main point here,  this story doesn't quite match up.  First someone sends you 'an' old etherium private key he 'found'.  So the keys may or may not be his, he sent it to you and you thought to transfer tokens out of this wallet that is neither yours and probably neither his??  At this point,  I don't know who is scamming who. 
But thanks anyway for revealing these methods so we all can have our eyes open.