Private companies have no limits on using illegally obtained information. It's very common practice. You're thinking about governments and law enforcement agencies.

But you also can't blame Ebay for letting the guy steal? Ebay just can't be blamed ever, seems like a great position to be in.

This is an interesting thought experiment. If the buyer acts as though they did not receive the phone, then on what basis can they complain if you look up metadata of an IMEI that they contend they never took possession of?

But when the lookup reveals that they did activate the device, now maybe you've inappropriately accessed someone else's PII and you did believe beforehand that the results would show that it was no longer registered to you.