One can just sell their username/password/private key. The plugin directory maintainer or the end user not necessary know there is a change of ownership.