Do we know what GDS Avelo is using? In other GDSes, is the confirmation code always sufficient to fully identify a booking? I was under the impression that PRLs could be re-used as long as the passenger surname was different.

The space of all possible PRLs is about 2 billion, I can imagine a really big Airline moving that many passengers.

They use a service of Sabre but not Sabre GDS. it’s called Radixx.

Yes in other GDS, it can be enough to identify a full booking. That’s why airlines prefer ticket or coupon number since the first two digits are the airline ticket stock / identifier and then fare codes, etc

The requiring last name, and more info is more or less security since any pss system can query the airline first for that combination before requiring more info to return a match.

6 alphanumeric, case insensitive characters only allow for about 2 billion unique combinations. I’d have guessed there were more reservations made than that?

Or are PNR locators recycled after a while?

Yes, I've got in my drawer two physical boarding passes with the same PNR

Confirmation codes are not sufficient on their own, they cycle through them relatively quickly so they have to be combined with things like the passengers family name to actually identify the booking.