In all honesty... requiring 2003 server is like requiring a linux 2.4 kernel. It's out-dated... and support for it is nearing 0. Microsoft has it marked for it's final "Extended Support" until 7/14/2015, after which... you can't get ANY kind of support for it. Oddly enough, R2 has the same date for end of support.
My advise... don't buy it. Similarly, I would NEVER buy server licenses from EBay... as there is no guarantee that the license is legitimate and the seller hasn't used that same license on other devices.
If this is a new server install, you can typically purchase an OEM license with the hardware for a significantly reduced cost. By default... you can't purchase less than 5 CALs... and legally you need 1 cal per device connecting to the server. (Experience has shown that this is left to the "honor system" however. Nothing will prevent you from having more devices other than ethics/legality.)
As far as licensing goes, Deal with a reputable company like NewEgg, GovConnection, CDW, or many others. There are also many different types of licenses to watch out for. Academic licenses you will frequently find on EBay for minimal costs... but legally can only be used if you qualify for the license. (Educational Institution, Student, etc...) Licensing can be a nightmare to figure out especially if you try and qualify for the many licensing schemes other than retail. I know many retailers actually have Microsoft Certified people to help you dig through all the legal-speak to ensure you are doing everything legal.