Sounds like the seller still has recovery access. Check if they set up recovery email/phone or linked accounts.
Immediately enable 2FA, remove all trusted devices, and update recovery info.
If that fails, contact platform support with proof of ownership and transaction.