Ethics aside, this is a pretty large oversight on the part of DHL. All you need to stop the incrementing is to require a second param such as the recipient postcode or customer surname. Plenty of other companies get this right.
That's actually how the german DHL website works - unless you enter the recipients postcode, all you get is information that's not telling you who the recipient is (that is, the shipment progress, the latest status). If you enter the postcode, the recipients name and the name of the person the package was delivered to (for example your neighbor) will be revealed.
I like the way how TNT asks for PIN to display pod details..