Probably 2012/13 accounts didn't have any security linked to them, no SMS, no email password, fingerprints, IP, etc. (Only those accounts without any activity after FB bought IG).
I think guys are trying "brute force" methods using old database breaches against Instagram and now Instagram will ask them to set up a new password because they didn't authenticate in the last 10 years and probably a phone number...
Nobody creates thousands of accounts and waits for 10yr to sell them .
The same method applies to YouTube too, in 2006 was sold to G....that's why we have old YT accounts on the market.