You can sell GPL software under all the terms of the GPL, but the users can redistribute it under freedom 0, 2 and 3. You can mitigate this by being a single source of development and offering support.

Yes, but once you've given a copy to a subscriber, you can't stop them giving that copy away to anyone else.

They will refuse to sell you it again if you do, and given that for security patches you need updates this is fairly effective. They will also refuse to sell to anyone who distributes their kernels, and thus would be obliged to redistribute source, you can only buy it for on premise use. So yes, it falls within the letter of the GPL, and it could in theory be distributed, but it is not in practise.

How exactly do they enforce this? Do they have any measures to stop a subscriber from posting their patches anonymously?

Even if they don't have any precautions at the moment, if that happens they could introduce them.

If the agreement does not prohibit redistribution of the source code once you have it, it can still be considered GPL.