People often turn down upgrades to full F cabins in exchange for social distancing in an open Y cabin without any shenanigans. Was E+ full, or were there open centers? IAD is a hub, so 1 and 2 could have been on a late inbound connection. Given the alternatives listed by you and myself and lack of any shenanigan evidence, one would be hard pressed to use this example to bump a thread without any posts in it for a year, about shenanigans.