I think it's a very simple matter. The original guy stole the info and passed stolen mdse on to someone else. Whether it's a car or info should make no difference. If the site knowingly received it the owner broke U.S law.