Here is my best guess as to what happened: some cybercriminal cracked into the account a little while ago, but was very careful not to leave fingerprints.
Then they went and found a buyer for the account, telling them they were brokering a sale from the original owner.
They gave the buyer the credentials, and told them to immediately change the ID, email address, password, security question, and so on, which they did.
When they changed the email address, EA confirmed it with the old email address, and I rejected the change and jumped into action. And now the buyer thinks the original owner is going back on a "legit" deal.
That's the most generous interpretation of events I can come up with, anyhow.