yes, it's legal.
I can't help wishing you'd contacted an attorney before taking any action. When you started repaying, the debt was probably already dead (unenforceable), depending on the statute of limitations in your state; but when you signed an agreement and started repaying, you started the clock ticking all over again. This was not wise. Furthermore, from the tone of your message, I get the impression that you really have no idea whether that collection agency even is a legitimate holder of the debt. If you don't have anything from the original creditor, they could come after you for repayment and the fact that you've been paying someone else would not be a defense.
These guys rely on the good will of just plain folks who really want to be honest and do the right thing. But this is not a moral issue, this is a legal issue. You only have an obligation if the law says you do. So please talk to a lawyer before making any more decisions like this. Half an hour of a lawyer's time will be cheap in comparison to the costs you'll needlessly incur.
You've gotten yourself on a debt treadmill, and the best you can do at this point is to demand disclosure of the terms of the loan and make sure you're not ripped off on that score.