I always assumed key sites were using stolen credit card numbers
I always assumed it was largely money laundering.
Claim to have bought a key for 1$ sell it for 10$. Declare you made a 9$ profit. In reality there was never a key for 1$. You bought a 10$ key with dirty money and are selling it at cost.
Fundamentally no different to the mafia run pizza place.
Why haven't vinted, ebay or for that matter facebook been taken down by law enforcement?