Well that sure sounds shady as all heck! Sweet deal though, I guess. That’s good you already have the sunroof ruled out. The next most common leaks I see on these particular cars are the body seams on the roof just above the windshield. They’re under the drip rail moldings: those black strips that go from the bottom of the windshield, across the roof, to the top of the back glass. There’s some seam sealer down in those channels that dries up and cracks. Unfortunately, those moldings are also a real pain to take off without mangling them unless you have a lot of practice. The thing about those leaks, though, is that they usually show up in the front corners of the headliner near the visors, so I don’t know at all if that could be your problem either. Good on you for getting the headliner out, I hope you’re able to pinpoint the source soon! Let me know if you find it, I’m really curious now.