They will refuse to sell you it again if you do, and given that for security patches you need updates this is fairly effective. They will also refuse to sell to anyone who distributes their kernels, and thus would be obliged to redistribute source, you can only buy it for on premise use. So yes, it falls within the letter of the GPL, and it could in theory be distributed, but it is not in practise.

How exactly do they enforce this? Do they have any measures to stop a subscriber from posting their patches anonymously?

Even if they don't have any precautions at the moment, if that happens they could introduce them.