This is pretty clever, but people might get double billed if they accidentally try to confirm their account with a different card than they used to sign up.
In my case, customers don't have any data on the account - it's simply a bit saying 'has paid for premium?'. And if I end up giving premium to a few people who didn't pay it isn't an issue. The sign-up friction of needing an email address is greater.
It will give them the cookie again if they re-visit from any IP they've previously used.
It also re-gives them the cookie if they try to pay again with the same credit card.
Support just tells people to try to resubscribe if their subscription has 'vanished' - but it seems to happen to very few customers.