Re: At what point...
Given that passive reconnaissance has been the first step since the beginning, this should be no surprise. If anything, buying data from legitimate services has been around for longer than we can know.
Yes, we might hope that these services vet their customers, but why would they care? Yet, even if they were willing, crims are in the business of shrouding themselves, and there's little hope of guaranteeing that this practice would never happen.