ty
So, it seems the suggestion "using phished FF accounts to buy codes" and "there was a hack on ff accounts using common passwords" are moot for code buying. (although valid for gil stealing)
Leaves it as stolen credit cards from Gramps Jones in Tennessee who believed the nice man from microsoft was going to fix his computer online - or companies like AT&T being hacked and their payment databases being stolen.