You don't need to create a new account at Baen, the codes work with your existing account, you only need a fresh email address to receive the code. Baen could surely stop that quite easily, but maybe it isn't worth it. Maybe the legitimate new business is enough to offset the exploit.
But yes, ultimately I agree. I don't participate in the chains now I have an account. (Although, OK, I couldn't resist going for two bundles when I signed up.)