When Salute tickets are sold or activated, we create what's called an "association" record - there's a new list for Salute each year. The information recorded is the military member's name, their DOB, their base or installation, and the number of tickets. That's how the 6 maximum is enforced.
But, the process is subject to CM error - people don't know what a spouse ID looks like, for example, so they create a record with the spouse's name/DOB and not the sponsor's. Or they create a new record for someone who's already activated 3 tickets previously because they didn't bother to check existing records first. Or they input the name in a way that isn't how it appears on the ID, so the next CM looking that person up doesn't find it and creates a new record. There are people who do go through and audit this behind the scenes, though.