I would hope that such a device would be wiped and/or factory reset before being auctioned off. However I've worked in IT long enough to know how all too often,

I would hope that such a device would be wiped and/or factory reset before being auctioned off. However I've worked in IT long enough to know how all too often, that doesn't happen. That said, I believe any claim that there was evidence of this machine having been tampered with or compromised should be viewed with some skepticism unless we can see said evidence side by side with a known-good machine. How is one to evaluate it otherwise if there's nothing to compare it to? Any thing dredged out of that machine's guts could genuinely seem suspicious, but how are we to know such wasn't simply the vendor's incompetence -- especially with as much incompetence in the design of these machines as has been brought to light so far?