Updating this thread as I once again got dinged for someone else's activity. Last month, I picked up an Impala with NY Plates at the Jersey City HLE and noted that the normally-mounted grey transponder box was missing. I didn't think anything of it other than it was nice to be able to mount my own EZ-Pass under the mirror and not have the big box in the way.

A few days ago, I received an invoice for activity corresponding to my rental dates but obviously not mine. It basically looked like a rideshare driver going back and forth via the Queens midtown tunnel, Lincoln Tunnel, and the GWB. I was able to use the email in the wikipost plus receipts from my own tolls and hotel stays to prove the activity wasn't mine. I wonder if the transponder was missing on purpose and someone has figured out how to run a scam...

In any case, the email still works and I received a response about two business days after I sent it.