Thinking more about this now, it should be pretty easy, in general, for DL to track the issuing employee if there really was a problem.

Buddy passes have to be assigned to the passenger prior to use, and that would involve a tracking # that would include the employee ID # within the system. And IIRC once it is assigned it cannot be re-issued to a different person, though the itinerary can be changed. Seems that could be looked up based on the traveler's name and record locator #. If the passenger were in an S3 category wouldn't she have her own # based on the employee's # (as a spouse, parent, child, travel companion)...and would most likely know the name of the employee.

And I can even kind of see how she might not have known the person's name. I've had friends-of-friends who have used buddy passes originating from the friend's sibling, former roommate, etc. I know someone who has used BP's from a friend's employer several times (employer is retired from DL), pretty sure she has never met the guy. However, in these cases one would hope the traveler at least knows the person's name if questioned.

Not disputing what the OP saw, just now that I've thought about it a little more, maybe it wasn't a scam, just some confusion over the way the priority was noted. Or if it was a scam, it shouldn't take much to identify the person who sold off the pass.

OP was the flight full? Lack of seats could explain why they didn't get on, of course.