I think the importer included journals that were deleted but not yet purged. It will certainly have included journals that were inactive by these rules.

The person buying the account will, the first time they log in to DW with OpenID, find out what they have access to, and it'd be surprising if they didn't have a poke around for the sake of curiosity.

I'm not saying this is likely to be used by attackers, but if I wanted to attack an account, it'd be pretty easy to go through their access list (if public) and find out which usernames to buy. As an example, if I deleted my LJ and you bought it, this is what you'd get access to.