You don't know they sold their account to a fraudster. You only know that the delivery address changed. That's a very weak signal.