You think its the Brokers fault? he did something wrong that raised Q? if so PM for his name, you shouldn't fall in with him.
Regardless of what happened from the time you sold your login until now, by selling miles (which you know is against the T&C's) you run the risk of this happening. Blame yourself (if you need to point fingers) and take responsibility for your actions.
The broker probably did nothing different this time then all the other (possibly hundreds or even thousands of) accounts he's bought and sold. This may very well be his only Parnasah and he (hopefully) knows exactly what to do or not do. That's almost certainly not the case with whomever said broker sold the account to (or the passenger, if he booked the tickets himself).
It's possible the passenger (or person the broker sold the account to) said the wrong thing to the wrong person, or the AA automated auditing system flagged this transaction.
But that all doesn't matter anymore as it happened already.