...How could original owner get EAP without paying for it?...
1) Since it is software enabling/disabling feature, Tesla has known to mistakenly allow the feature on without proper payment, not just on EAP but others as well. One popular complaint was they didn't pay for a longer range and they still were not capped for the corrected shorter range!
2) It's possible that the previous owner did order EAP but then didn't want to pay for it so although the Monroney Sticker still includes it but the purchase receipt excludes that feature. It's possible that the EAP was erroneously not stripped off during the delivery.
3) It's possible that the previous owner had an EAP trial but due to a software glitch, it was an unending unpaid trial.
4) Also, EAP is unique because Tesla sold EAP before and clearly advertised that they only could use 4 cameras and if you wanted to use 8 cameras you have to pay for FSD.
However, instead of disabling 4 cameras, it went ahead and grandfathered EAP owners to use 8 cameras as well as many features from FSD that requires 8 cameras such as Auto Lane Change...
So, when Tesla has got an EAP car back into its possession because of a lease, trade-in, buy-back... it would strip EAP away and make new owners pay for 8-camera features with FSD price: Auto Lane Change, Summon, Autopark, Navigation on Autopilot...
So, in that case, it's not that the EAP was not paid. It was already paid but inconsistent with current inhouse Autopilot / FSD, 4-camera / 8-camera feature pricings and thus, it must be stripped.
But in summary, since we are in a new era of over-the-air repossession, it's quite unknown for consumers to protect themselves because Tesla doesn't physically knock on your doors and tell its intention. It's sudden repossession first then talks later!