If you're going to escrow account sales, especially for new users who don't know any better, you should help them do it properly.
Agreed, I could have handled this better to possibly prevent the account from being sold by the hacker. I'll no longer escrow account sales where I do not first secure and inspect the account first. My previous view on the matter was that I know some (albiet few) people, especially when it comes to account trading, are paranoid about having the identity of the account released to escrow. So based on that I assume the lack of details provided to me were because they rather not disclose the identity to me, and I respected that.
I believe I am definitely at some fault here for not offering/insisting on securing the account from the buyer. The PMs exchanged between the buyer,seller, and myself were very brief only describing the account rank and activity level as well as trust ratings. I'll definitely do things more securely in the future to help better protect both parties of the transaction since there is such a huge influx of hacked accounts being sold as of late.
I apologize to OP for not being able to catch this at the time of the transaction. Having escrowed so many account sales in the recent months since I started my service, I definitely should have known better. If the account bought by the user "Crypto Junkie" is revoked and given back the it's original owner then I'll be happy to compensate the 0.071 BTC back to him out of my own wallet.
Even if you secure the account prior to giving the credentials to the buyer, that would not protect him from the account being hacked. Although it is 100% necessary to have the credentials be sent directly to you for you to change prior to forwarding to the buyer in order to prevent any kind of dispute that the credentials sent to the buyer do not work, ect. (there would be nothing to stop a seller from providing a password that does not actually belong to the account).
In regards to getting a signed message, you should always make this the default setting when drafting an escrow agreement. If the buyer says that one will not be provided then a warning should be provided that this is not a good idea, and the risk that the account is hacked. If they insist on proceeding without a signed message after receiving such warnings, then it is not your position to stop them from making a bad decision, however you should make it very clear that you are recommending not buying the account without a signed message. The majority of the time the buyer will either insist of receiving such a signed message or will decide not to buy if the seller is not able to provide one after being notified of such risks.
I have had a number of deals end up falling through recently because the buyer was not aware of such risks of buying accounts without a signed message. In other cases, even the seller did not know the importance of providing such a signed message and ended up providing one when the buyer was made aware of the risks not having one.