I might be able to shed some light, and this would be true for UK mobile operators. Not sure about the US.
If the owner has reported it lost or stolen, then O2 will have barred the account (SIM too) and also blacklisted the device. Essentially, every night, mobile operators will sync blacklisted devices so that none of these devices will work on any network. I actually think (if I remember) this is a required action by law. If the phone isn't black listed then it makes theft of phones a viable crime, if they never work after stolen, then people won't get mugged for them as they can't be sold on. If that makes sense?
IF a SIM is put into said black listed phone, O2 will have a record of all SIMs & MSISDNs which have ever been put into or used in that IMEI. So you could get linked to it, if they wanted to. It's not unheard of that a mobile operator will contact the owner of the next SIM placed into a stolen device as they are likely to be the mugger/thief, and said person may get a knock on their door. Mobile operators don't have the sources to make this happen in each case though.
So really, there's no gain from keeping the phone, and you're putting yourself at risk if you sell it as you're selling goods considered as lost/stolen by all the UK's mobile operators. I can bet you that O2 doesn't have any kind of process to take back lost/stolen handsets that get found.
The ONLY positive thing that can come of this, is to return the phone to the owner. It's within the power of O2 to unblacklist the device, but you can bet they won't do it for anyone but the original owner. If O2 were particularly clever, they would have a process in place to collect the found iPhone for refurbishing and putting back into the replacement supply chain.