I don't know if GOG also removed any illegitimate keys. There were a few topics about this in the Steam forum, so Steam didn't notify people when they removed the games.
If you buy a physical product that turns out to have been stolen, I think it depends on whether you bought it in good faith, or not, as to whether the original owner can claim it (and probably whether it was a personal item or family heirloom, etc). If you buy something off the back of a truck, you can not claim to have done so in good faith; if you got a reasonable deal on Craig's list, etc, then the original owner might be out of luck if they can't go after the thief. With a retail store (maybe excluding pawn shops, etc), there would be no expectation of it selling stolen goods, so the responsibility would stop at the store.
For digital goods, there are very likely clauses in the GOG/Steam user agreements that cover this type of situation, and G2A at best resells keys bough during sales and grey market keys across pricing regions (in violation of the distributor's terms of service).
GOG can't really give a refund for a key purchased elsewhere. Good luck with G2A; it would be worth trying, if the original key was illegitimate, but in a couple cases I have heard about they were not forthcoming with a refund.
