The law is more grey than either black or white. People get in trouble when they think they know something is cut & dried when in fact it's always arguable.
Some other commenter recently said "the law is not autistic".
In this case of course, there is an ocean of valid keys that were purchased or otherwise obtained legally, but under terms that said "you can't resell them or use thim for this or that purpose" but those terms may just be wishful thinking. Just because you write down a demand, even in a contract, even in a contract that both parties agreed to, doesn't garantee you actually ever had a right to that demand or that the other party is obligated to honor it. It might be, or it might be only in some juristictions and not others, or anything else could happen if you put it to the test, and whatever result might even not be final even if you do get your way.
Even if the act of selling or using the key was able to be squarely established illegal, that does not necessarily matter to any downstream recipients. Maybe the key itself is still invalid and MS can detect it and invalidate it any time they want, but that doesn't necessarily mean the end user in in any legal risk since a lawyer might be able to argue that they didn't knowingly do anything wrong (they just bought a computer). Even the recycler might be able to say the same thing, that they just bought keys from someone else. Their legal obligation and cuplability would have to be proven, not just assumed.
The world, including legal departments, has almost no black or white anywhere in it. Merely people with interests in trying to convince you that there is black & white, and they know which is which, and you better give them everything they want with no questions or contest.