I would never want to go up against blizzard legal, but I have a hard time with the "trade secret" bit when the box came from eBay. The guy didn't sign a contract with blizzard.
I have cds with intellectual property on them. It's not like he's copying it all willy nilly. No different than finding a manual of procedures for some random organization.
The only "real" risk seems to be possessing stolen property (maybe, could have been a gift or souvenir). But stolen 20 years ago and never reported.
I can't understand how keeping the disk is particularly bad. But good for them for giving it back. I think it belongs in a museum, but back home at blizzard is ok too.