Today I recieved this response from Namecheap support, confirming that my account had unauthorized access to a domain after it was sold in the marketplace:

---

I can see that the domain you mentioned is still shared and can be managed by your account, even though it was sold via our Marketplace. It will take a while to investigate the case properly and fix the bug.

I'll ask the team to keep you updated on the progress. As for the domain itself, due to security reasons, we'll need to revoke your access to it.

---

Anyone who has bought a domain through the "sell domain" feature - you should immediately check for unauthorized access to your domain(s).