Also, the ones who sell two or more times, can just claim that the other buyer actually discovered the exploit themselves?

Or maybe that someone in the first buyer's organization resold it?