They use a service of Sabre but not Sabre GDS. it’s called Radixx.

Yes in other GDS, it can be enough to identify a full booking. That’s why airlines prefer ticket or coupon number since the first two digits are the airline ticket stock / identifier and then fare codes, etc

The requiring last name, and more info is more or less security since any pss system can query the airline first for that combination before requiring more info to return a match.

6 alphanumeric, case insensitive characters only allow for about 2 billion unique combinations. I’d have guessed there were more reservations made than that?

Or are PNR locators recycled after a while?