I’m curious how access was provided to these sold accounts. The password change implies the passwords were shared and that means plan text password were available to admins!?
I think you're right though--it does seem like they must have sold the passwords themselves. It's interesting to think about how you would sell access to an account if you wanted to.
You can do a "takeout" of all data in the account and sell that. Or it can be anything that is requested, like a dump of all the private messages.
You can change the password of the account, possibly at a time like 3am at the user's local time so they're less likely to be using the account, then change it back at say 5am. This requires DB access.
You can find the user's session token/id if they're logged in somewhere and sell that.