He guesses VMWare stores credit cards based on them using the last 4 digits to help identify orders. Actually, it is probably Digital River, not VMWare. VMWare uses Digital River to handle actually process orders. (That's why the site he went to for order lookup was findmyorder.com, not vmware.com. Findmyorder.com is a Digital River site).

You can't really infer credit card storage from them keeping the last 4. Merchants need to keep the first 6 and last 4 in order to process chargebacks and refunds. When a customer charges back all the bank tells the merchant is first 6, last 4, and amount of charge back (oh, and the date of the charge back). Furthermore, the amount does not always match an amount the merchant charged. So, the merchant needs to be able to look up orders by first 6/last 4, approximate amount, and date-that-it-must-have-been-before.

PCI allows first 6 and last 4 to be stored unencrypted and kept as part of general customer information. The strict security requirements (encryption, kept off of networks not involved with actually using the card, and so on) only apply to the rest of the digits.