ooh. This is a strange one.
IANAL but I suppose the terms of service would be the thing to look at here. I don't see anything explicitly talking about transferring an account but
Subscriber is solely responsible for any use of or action taken under
Subscriber’s password and accepts full responsibility for all activity
conducted through Subscriber’s account and agrees to and hereby
releases the Network and Stack Exchange from any and all liability
concerning such activity.
That said... well, it sounds fishy. No offence, but while it is a decent amount of reputation, you can make that much reputation in a few great days or a few good weeks.
There's no good reason to buy an account either. You're the real asset as far as your account goes. In theory I could start a new account tommorrow, use it, and catch up with myself in 6 years or so. So... this person is obviously not up to any good.
As for where to report it, well, unless someone is dumb enough to sell their account for a quick buck, basically any attempt to misuse it would result in the account getting suspended or deleted, and other such lovely things. I'll probably ask around, so keep that email in case a CM's interested, but at the moment, getting folk knowing that this happens is probably a good start.