They need to resort to the mechanism agreed upfront to prove identity. Usernames, emails, numbers + passwords, keys etc.

At this point I see this practice mostly as deterrance with a little cya mixed in, possibly with a pinch of data fishing in some rare cases.

However in the future I'm all for providing IDs as a requirement to use webservices if that makes people more conscious about what data they share.