Passport details don't really matter this early in the application round. Say for example in many countries a passport has a ten year validity before you need to apply for a new one in order to travel. Well in theory then there could be 10% of all people's passports expiring in the next year leading up to the tournament as we are applying a year beforehand. Yes they say when you login that your information must be accurate and cannot be changed blah blah blah but it actually can just by contacting them closer to the time and providing the necessary proof of identity (this has been confirmed in that other forum linked).
In terms of multiple applications, this can range from applying with real identities of all your family members and friends as seperate accounts to applying in multiple versions of yourself such as fudging details of name (eg. John Jon Jono Jimmy James Jonathan), date of birth made up or swapped (ie. americanised month then date), a different address or formatted differently, passport number one digit or letter different/swapped, different IP address and part of the world, different bank card payment etc. Not that difficult if you wanted to do these things. No one knows what kind of checks or controls UEFA have in place this time to prevent these sorts of things but they have worked in the past no problems according to other forums and people. One may come in to problems if you ever have to deal with people face to face and couldn't prove a certain identity or if you are found out, but for a ballot application one year previous where tickets are then sent to your address much later (if this does happen instead of Mobile App ticketing that was also suggested) there wouldn't really be too many problems. Not condoning this sort of behaviour though.
Also the numbers and probabilities that other user is suggesting are a little off or very simplified but along the right track.