It’s not too weird for 306 accounts to be using iCloud from the same IP, considering stadiums, universities, etc. It’s probably highly unusual for that many of them to do an account recovery… unless the IP is an Apple store.
It's not weird for 1000 users to be simultaneously connected via the same IP because of CGNAT. This is where you would have to do something like browser fingerprinting to try to work out if they are the same person.
Browser fingerprinting works best on the Wintel and Android ecosystems, but fails on apple's devices because they are extremely uniform, and apple has been working on making them even more uniform. As apple products are designed to be used on apple devices first (and I guess also tested on them first), it would be unlikely that they employ fingerprinting.
This is trivial to overcome with a VPN. There's nothing that suggests that he was connecting from the same IP each time. Based on the article, he could have just easily forgot to sign in to a VPN before logging in and that mistake unraveled the whole thing.
