I think that Netflix uses the boxes serial number.
Netflix is known to track the number of devices you use streaming from, but not for the purpose of authorizing account access. AFAIK, they use it only for limiting the straming devices for an account to some sane (or draconian, depending on your view) limit. Supposedly they have an interface now where you can list and de-register a streaming device if you've hit your limit, but I haven't seen it. I've read reports that in the past you could easily call up support and they could remove a device from your account (and they supposedly knew the MAC and OS).