22,000 now, but there was no limit and more importantly no rhyme or reason or other way to tell what was a third level registration and what was a subdomain on a normal second level registration

Verisign could have published a list of every third level registration, it wasn't an impossible problem to solve, but it is different than static regional TLDs like .co.uk or .<state>.us