"so they go to the store and just sign up with the phone?"
Yes, they need to sign up with AT&T.
"how do they know if a person didn't steal the phone?"
They don't.
They just assigned the id numbers to the account as they do with all other cell phones.
When the new owner takes it in, they will do the same thing.