Originally Posted by MSPeconomist

I too am curious about how UA got the OP's information. Did the eBay listing perhaps contain a picture of the cert with a cert number? Or does the OP use the same email address as on the UA FF account? Could the OP be from a small enough town that there's only a small list of likely suspects, particularly if the listing mentioned 1K or GS status?

If the OP never sold a cert and if eBay won't release the information, then I think we can assume that UA saw something in the listing that enabled the security team to identify the OP, assuming that the OP's story is correct and it's not a UA "plant" as someone suggested upthread.