Trust me it is no where near that simple in implementation, it's 1,300 lines of code just for the part that flags the items. I appreciate the complexities are not obvious, but we have spent a lot of time looking at the edge cases here.
I will not go into the details of the exploit, however there were a number of "artifacts" that could be used as a seed.
The system that does the tagging has 8 separate phases that unpack each level of detail to match items, not just a simple s/n counter.
If we just sorted based on s/n's we would have flagged 100 million items.
That said when you do see a s/n with thousands of copies and its a loot item not a manufactured item, pretty clear what happened there.