Confirmation codes are not sufficient on their own, they cycle through them relatively quickly so they have to be combined with things like the passengers family name to actually identify the booking.