Comment by bquest2

This is partially the answer. Sometimes people are running ad blockers that block sending events to Facebook, so the "Item Purchased" event never gets sent, but the account was created with an email that can be used in custom audiences, so the email is retargeted as if they never purchased the thing.

Or someone goofed and forgot to include the exclude "item purchased" event in the criteria