Is it vulnerability? Or is it just something to be aware of. 

I think it important enough to report so that at least others are aware.

eBay offers a certain level of security to their members.  Basically, you choose an ID and a password and make sure you do not respond to phishing emails from look-alike eBay messages, and all will be well, right?

Well, certainly, these practices help to secure your eBay account, but there is another way your reputation can be harmed on eBay.  Many members tire of their chosen ID and decide to make a change.  Simple, eBay allows it.  Everything associated with the old ID magically is now associated with the new, and, if anyone looks at the ID history, they can what you once called yourself as well as what you call yourself today.  (Well, with some exceptions such as on eBay match-ups, where the comments remain associated with the old ID.) No problem, right?

WRONG!!!

I can go in and register a new account with ANY old, but currently unused ID.  (If the ID is associated with an account that has been closed, or Not A Registered User, it appears the ID is protected from reuse by another member.)  What does this mean?  Well, at once, anyone who ever had any relationship, be it buyer-seller, blogger, eBay matchups or whatever, with your old ID who does not know that you have changed your ID, will presume that ID is still you.  This can work very well for the new eBayer who wants a quick “name recognition” factor.  Simply buy up a few penny eBooks to get that feedback number up and the casual observer will never even think that the newly re-employed ID is not the same person with whom they had previous dealings.

Good Idea? 

In the world of Identity Management this is a huge no-no.  Once an ID has been used, it should be retired and never used again, save by that same person coming back to reclaim the ID.  There are serious non-repudiation issues that arise from the presumption that a person is who he says he is.

But eBay DOES note this in their rules, so being aware is important....

Below is an excerpt from the eBay help pages and it clearly states that the discarded ID will not be able to be used by another member for 30 days after the original owner discards it. 

Here is the help page on the matter.

Your User ID is the unique nickname you choose for signing in when you first register at eBay. You can change your User ID (once in a 30-day period) by going to the Change User ID page.

Before changing your User ID, review the following important information.

When you change your User ID, the change will appear immediately, even in listings you're participating in.

eBay will automatically attach your member and other important account information, including your Feedback Score, to your new User ID.

The "Changed ID" icon will also appear next to your User ID for 30 days.

Your old User ID can't be used by anyone else at eBay for 30 days.

You can only change your User ID once in a 30-day period. This is to prevent confusion for other members. Your User ID is a valuable asset, like your Feedback profile. Trading partners will come to recognize you by your User ID, so it's a good idea to choose one you'll want to use long term.

Note: As of November 2001, User IDs that are an email address, a URL, or a look alikes are not allowed. For more information, see User IDs Policy. 

If you'd like, you can also change your password.

Tip: If you forget your User ID, you can have it sent to your registered email address.

My suggested solution?

My suggestion to take care of this "acceptable" risk that eBay has provided you with is quite simple.  30 days after you change your ID, go and register a new account with the old ID.  Then, close the account.  Once closed, it appears the ID will be protected from reuse by another member, either by chance, or by design.