Stalker login - MAC address

When service providers use Stalker portal for logging in, TiviMate generates a 00:1A:79:xx:xx:xx MAC for the playlist. There is no password because MAC is expected to be unique for each device. But I'm puzzled that TiviMate allows the MAC to be edited. Wouldn't this allow the MAC to be easily spoofed to get around provider restrictions?

Besides, since the prefix is always the same, does that mean only 16⁶ = 16,777,216 logins are possible using this mechanism across the world? That sounds low.

What am I missing?