The individual filing doesn't need an identifier for the Company for which the filing is made, as each filing is indexed under their CIK as well. And, the cover page of each filing also includes the Company's CIK.
That is why you can search on EDGAR by CIK and every filing for that company will come up, regardless of who made the filing.
And the passcodes are real codes. To make a filing, a person has to be able to log into EDGAR using their assigned CIK and their password. Once in, they will need the CIK for the Company for which they are making a filing and that specific company's CCC number. Only the CIK is public. The passwords and CCC (and other portions of the assigned codes) are private. Which means the person that made these filings had to have obtained the actual, private codes of these companies somewhere along the line. So someone with knowledge of those codes was part of the scam.