Here's an update for you guys. Very odd end to it by the way.
I ended up emailing the seller (thief) and just asked him to turn over the email he hijacked to the original owner, so 'we' could gain control of the registrar. He agreed with an apology for the trouble he'd caused.
I had the original owner set up a new registration account with the same email, address and name as the thief's account where it had come from and I then pushed it back. So now the original owner has the domain and I'll be refunded my money (less the $170 Escrow fee, well worth it).
As of yet, we don't know who the thief was, but my money's on smurf. If/when the owner does file a report against the thief, Escrow.com has their details on file. Though I was not told the thief's exact location, I WAS assured that they are in a location that makes them prosecutable.
