It is indeed the way they do, but you are saying he should've known that, when he had in fact no way of knowing.
That's why I'm suspicious as to which name he actually entered.
At least this was the case with the cards issued for authorized users I added to my Citi Double credit card account.
So you could have a single card number with multiple valid names/users.
In this case, it seems the two accounts used different names otherwise they would mentioned it already because it's huge evidence that the accounts are linked.
For example, Mithaldu, if an anonymous outsourcing party rendered you a service, than rather than wire them money or pay via paypal, would you be okay with paying for an apple account with them, with no further relationship, and you don't even know who they are? Probably not.
I think we can all agree that yes, he "should have" thought about this implication of trust.
[edit: given the down votes, I guess the HN crowd has rich friends or doesn't do mentoring. Sometimes the people you sponsor don't get it right]
A developer account + some old test devices sounds like a great birthday or christmas present!
It was a relative, so I don't get your question's relevance to the situation.
You might want to read the rest, the relative was boosting their own apps. Dash was not part of scenario just affected by the end result.