If I understood the site's content correctly the answer to 2nd question is yes: At each distribution, each Icelander citizen will be given coins only once, so I guess one AUR-address per Kennitala ID is enforced somehow.
The part I'd like to know is how they're going to track which citizen has applied for which distribution: Should a lot of coins remain unclaimed from 1st airdrop, the total will be distributed again, and again, and finally (in case a lot of coins are still unclaimed) a bunch will be destroyed and the rest donated to a charity.
So a crypto-currency savvy Icelander could potentially apply for all 3 distributions, a less savvy might apply for just the last 2 or even just for the last one. And they'd all be using the same address each time. Unless they're using a centralized database, how to know which citizen has not applied for current distribution round?
A theoretically perfect airdrop should concern only with a citizen with a valid Kennitala, not on whence in the world they're connecting from, hope organizers are not using geolocation.
Some people have tried to hack the airdrop system. So far, it seems the Facebook algorithm is not so naïf as could be expected: as the activation via SMS to the citizen's registered cell-phone seemed much unlikelier to succeed, the blog's author grabbed a kennitölur number, located the full name and created a Facebook account ex-professo. It failed!
It must be indeed possible to game the system as some Icelanders have complained in the forums of someone else receiving their coins. But then some others complain of the system rejecting them (false negative). Too bad most of the recipients are cashing right away, provoking the drop in prices currently seen. In the future, other national-economy-savior coins should take this into account and do something to void it.