Robbery of Express Owners

A home IP address is in most cases dynamic, meaning it changes after a certain period of disconnection from the network (for example, turning off a router). In principle, when it comes to a standard website, the website has no way of identifying a user who deletes cookies and the like or changes their IP address. There is a method called fingertip that comes close to this, by storing a combination of details that are difficult for the user to change (for example, browser, operating system, etc.), but as far as I know, it is not usually used.

This is a purchase via an Android app.

What is the general rule? If they have a potential way to block and they choose not to, then is it permissible?

I think that's at least inappropriate. It's hard for me to impose a ban here.

Maybe I'm wrong, but it sounds to me like it's forbidden. They offer a discount (huge and etc.) to a new user, with the clear goal being to add people to their ”customer club”.
You're not a new user. And morally speaking, you're not doing them any harm by adding another email to the site, you're just putting a negligible burden on their servers.
This doesn't seem any different to me than any sale that's limited to one unit per customer – you can always trick the responsible system and it's always a rip-off.
Where am I wrong?

I think they can point their finger at checking past purchases made using the same card, and if so, cancel the discount.