So, a serious question: Could UA (realistically) restrict what can be done externally with a ticket, as a matter of policy, once a passenger has boarded (well, been "scanned in")? Basically, could they have the system set up so that only the pax (or someone in their party) or the gate agents at the departing airport can change a ticket at that stage? It seems like allowing an external cancellation after that point effectively violates the UA policy of not kicking someone off after they've boarded.
Setting that aside, I think UA might want to consider dropping a brick on the OTA in question. This isn't Expedia or Orbitz, so it might be worth UA's while to come out and "fire" them and to restrict what a third-party seller can use as a claim for a fraudulent ticket purchase (e.g. "an SDC or SDS change is, all else being equal, not considered suspicious by United and we will not consider a cancellation request on this basis to be valid").
FWIW, the blurb on Google about the company in question: " 24*7 Online support help desk for travelers looking for customer support for travel related quires, airline contact numbers, air travel reservation query, flight status and more". Bold is mine. Yes, that's "quires", not "queries"...boy, does that inspire confidence.
But I'll also agree that this would have been a case where some quick thinking on the part of the gate agent would have helped and should have been rewarded.