1st thing that'd tip you off is a changed password, but the "Warning" is only showed for a month
2nd thing, a change in style of writing
3rd , change in use of address.
And many more, you are asking this for "Educational purposes" right?
These "tells" can easily be circumvented. I guess only Theymos can tell for sure, as he probably has access to all accounts' IPs.
One way is when an account forgets to log out and responds to a thread as a different account, accidentally.
One example was a person, Pov, who I was about to trade with him until he accidentally logged in and responded to his own thread as a scammer, armour.
1) as you said, people can hold their account of a month, then scam.
2) this isn't usually checked, but a person fluent in a language, say English, can replicate a person's writing style.
3) usually when buying accounts, people ask for the private key of an address used to sign an account.