Your hypothetical would not carry all that much water. For one thing, this person would not be considered an official entrant in the Boston Marathon--bib number or not. All official entrants must complete the required paperwork, waiving their rights and claims for liability and damages against the BAA for any and all injuries (or death) suffered by the entrant.
This person would not be an entrant in the Boston Marathon, but rather a bandit who has a number.
I can imagine him pleading his case, in the hypothetical, after sustaining his knee injury:
"So, I broke the law by committing fraud and falsifying my identity. Now I would like to sue the BAA for sustaining an injury in a race I was never sanctioned to participate in, and am not officially recognized as a participant in. In fact, I was not registered as entrant and I am not in the results--but I do have this piece of paper with a race number on it!"
Anyways, all people would be subject to Massachusetts state law. Chapter 397 of the Acts of 1998 will give you an idea on False Impersonation and the punishment. While I will not question the morals of this Ebayer, I do know he signed a contract with the BAA stating he would not "reproduce or transfer [my] running number" on "pain of my and my transferee's disqualification from this and future competitions." Thus both the Ebayer and the winning bidder would be DQ'ed anway.
My long-winded point . . . the BAA have covered their bases and should not need to worry about lawsuits from unregistered, illegal participants.