Even something as simple as a checksum of the game key needing to match the last digit of your steam id would solve the problem, and would be trivial for humble/steam to implement. Every time someone requests a key from their bundle, the bundler just had to find a remaining key that matches.

Edit: I originally speculated that perhaps it wasn't in Steam's interest to support this, but thinking about it, they're losing their cut of these dodgy sales.