However, recently two-factor authentication (2FA/OTP) has been added, creating a new possibility for account traders, where account ownership can change by the new owner changing the OTP. The password and email can theoretically stay the same.
It may not play out like you imagine and the reason is quite simple. Now in order to make changes to your 2FA details for OTP generation you need your password to apply changes and as a result the account buyer wouldn't want to risk leaving the old password. Aside that, even if he did, how sure would he be that the seller isn't logged in still?
The truth is account traders will still get a way around it , they could choose to change just 2FA and later on change email address so it looks like a regular change an active user would do.
With your valid points, I don’t think there is away that account traders can get away successfully with selling an account and the buyer not get caught in the act. It is simply ideally that any buyer of an account will immediately change the password to the account and subsequently the email address attached to the account, they can’t risk buying an account without having full ownership of it. It may take a while for them to start posting on the account to avoid immediate suspicion in the pattern of post, but those changes they’ve made will raise an alarm and such accounts will be put on surveillance.
Many things will change from the way the account usually operates in the forum. This will range from; the pattern of post might change (knowledge of the forum and crypto in general), time of post and also their grammar too. If the user was an active user of a local community, they may not post there again because that’s a good way to catch them and they won’t also try to go into another local board to post unless the buyer is not wise. Even without BPIP not able to detect OTP changes, account traders can still be caught.