From another article, this seems to be what happened. The cart was purchased via FB Marketplace from somebody who had also cloned it to a multi-cart. Detection likely occurred due to the same cart ID showing active at two places.