A while ago, maybe around 2007ish, Microsoft got some legislature pushed through that made "pulls" illegal to sell. A "pull" is a license from another machine (typically OEM). What was happening is companies like Dell would liquidate overstock, and a company would buy several hundred (or thousand) computers that were effectively brand new, pull the licenses, sell them, and then sell off the rest of the pieces of the computers separately. This became very profitable because they were selling current versions of software for a fraction of the price of new. When the legislation came down, several companies I had been buying bulk licenses from suddenly no longer had anything available.
It still happens a lot with used computers though, although usually it is ebayers and other small time outfits that do it, and either through ebay or as a reseller on Amazon, Newegg, etc. The licenses work, and are legit in terms of being unique and not installed on a running system, and they often come with the COA to make it "official". I have sold hundreds of Office licenses that are no longer in use, and there is a lot of money in it. It is technically illegal though, as well as against the license terms.
You won't find this happening much in the newer versions though (i.e. windows 10, office 2016, etc.) First off, MS no longer provides the actual key with the COA. The key on the COA is a redemption key now and you have to log into a MS account to activate it, at which time you get an actual key. That key works to install it once (or 3 times on home licenses) after which you have to call MS to get it to work (if reinstalled). In Office 2013, after a couple months of businesses yelling and screaming, MS made it so you could activate the software without having to have an MS account, but for 2016 that ended.
Windows 8.1 and Office 2010 are the last times you will get to buy a working key that you don't have to call MS and tell them this is the first install to get it to work. Anything newer, if you buy a key that was installed once before, you will have to call to get it to work, so this practice is ending.