You need to sign in with a Xiaomi account to unlock devices, presumably they have similar spam protection to other big companies, IP addresses, device fingerprinting, etc.. So if you unlock a device from account A, then account B tries to unlock a device from the same computer/IP address, you'd be caught.

Given the amount of users who actually bother to unlock their bootloader, I doubt you'd need more sophisticated duplicate account detection

They verify by phone number.