When the ID changes on the tag, a nearby device can link the two id's together since they're in the same 'position' (i.e. id x was at y position and now id z is there, so id x = id y). However, someone who is not there wouldn't be able to link those ID's together. This gets you the privacy feature and the anti-stalking feature. (The anti-stalking feature likely wouldn't need a perfect series of matches; if you have a good chain of them, you'd have good confidence.)
They do have a very comprehensive simulation system with a large part of the work being done at Dobbins Air Force Base just outside of Atlanta. From what I understand, the team is quite small (<10).