Ip address, browser finger printing, cookies + google analytics is enough to identify who is using what service. They don't need an account to tell who you are because most people surf the web with multiple active sessions on other sites they're logged into and that makes it trivial to know who is doing what.

I think it's because their spaghetti-laden backend code can't survive any additional changes.

Yeah, ok.