Actually, the guy who bought it should NOT have been able to activate it and it's surprising that he didn't contact you about this.
Why is it surprising? With all the posts and issues where people whine to get what they want (regardless of expense or morals,) why would it be a shock that a CSR did something they shouldn't have and released the unit to an unauthorized party?