Another one of my theories;
OP bought what he thought was a "replica". That's what the seller said and there was nothing to indicate otherwise. The FFL thing was weird but who cares, it's a replica, the FFL being involved only makes it clearer that everything is OK.
FFL receives "replica", but to them it looks like it could be an unserialized "firearm". So they contact the ATF.
The ATF believes it is a firearm. So they start looking into it. They probably look at the buyer but with no evidence he knew it was anything other than a replica, and that he never took possession, they don't have anything. Besides, they don't want the buyer. They start looking at the seller. If the seller looks to be in the business or selling illegal firearms they will go after him, but more likely they will use him to go after the manufacturer/source.
ATF might want testimony from the OP at some point, but maybe not. They have the shipping/FFL records, they don't really need the OP.
Personally, I'd have a a brief conversation (the free kind) with a lawyer and keep his number handy (having a lawyer's info on you is a good idea in today's world). If he hears from the ATF, contact his lawyer and cooperate (in that order). Otherwise write off the cost as a learning experience.
Just my thoughts IANAL