Just spotted this - I'm the unfortunate schmuck who runs thefretboard, and this particular set of scams (there were more than one) came down to accounts compromised through two vectors: one was a man-in-the-middle attack, and the other was simple password reuse from other sites that have been breached. The scammer would compromise an existing user account with good reputation, change the email address and then get scamming...thus bypassing all the in-community protections.
Given that enforcing MFA would destroy the site's traffic, and forcing everybody to change their passwords would be...unpopular...the simple solution was to prevent users changing their email addresses (they have to come through admin requests now) until I can finish rewriting the forum software to actually not be junk.
Just on this other point...
There's a very good reason, and we had one scammer in the early days who took loads of people for a total of thousands - he'd do it across guitar forums, photography forums, even a Jack Daniels enthusiast forum. The point is that Action Fraud don't care unless there's a pattern of high-value crimes; even when presented with all the evidence they need to make an open-and-shut case, they won't touch it when the value's that low. His approach was depressingly simple...he'd just sell the same thing over and over again, and post an empty envelope via Royal Mail Signed For to another address on the same street. Because they only tracked stuff by postcode in those days, he could "prove" that it was signed for, but the buyer would never know that there was nothing sent and RM would back up his story.