Generally, I uniquely identify users by PK sequences on a table with UNIQUE constraints on various pieces of User data.
So if Apple had made credit cards and/or test devices UNIQUE to a given account then sure...but that's not what they did here did they?