All that's needed is a piece of information that ties to other pieces of information. In the case of online transactions, CC numbers, cookies, or other submissions of email addresses can be used. These can be correlated by the primary marketer, or by corrolation services. For the purposes of email mass-mailings, a relatively low probability of a direct match is likely acceptable.
\r\n\r\nIt's for this and other reasons that I minimize the amount of business I transact online, and the amount of data I permit to be emitted. My cookies file lists 27 entries, and only 13 sites. My cookies permission file lists over 1690 sites -- these are sites which for the most part aren't allowed to set cookies. Yes, it means there are parts of the Web that don't work for me (or don't work in my primary browser -- Washington Post, for example, is accessible in lynx). I can live with the trade-off. The data are virtually always available elsewhere.
\r\n\r\nThis isn't a perfect method, but it slows the bastards down.