What the vendor should have done was to deactivate the cd key, then all the buyer has to do is re-activate.

It is also useful to deactivate prior to reflashing the device, sending it back for repair or replacement, etc.