So the scammer was generating addresses that they had the private keys for, then giving the user an uncorrelated private key?

Excellent writeup. Reads like a mystery novel.