I think it's mainly to prevent spam/multiple account creation. Having different CCs is harder than just multiple emails. It also makes it easy to upsell you to paid plans.
Don't many banks issue virtual debit cards at negligible or even at no cost?
Heroku may have address fields for invoices and stuff, but I really doubt they can validate it (except for country/state) with bank, as addresses are real mess. At the very least, not automatically. So, this probably won't work for abuse prevention.