I'd guess that they track keys which appear on reseller sites. So the "bad actor" comes from later use, not from e.g. stolen Bitcoins.