[gshulegaard]

Generally, I uniquely identify users by PK sequences on a table with UNIQUE constraints on various pieces of User data.

So if Apple had made credit cards and/or test devices UNIQUE to a given account then sure...but that's not what they did here did they?

[CodeWriter23]

So yes, you use a single token. Apple used a token and a credit card number. That's two pieces of identifying information.