It may be a registry hack, it may be an app, or it may be any number of things. Another thing to remember is that Microsoft is planning to use different Product ID schemes for different media. Hence, if you have a retail version of Windows XP, you won't be able to use anything but a retail Product ID to activate Windows. Personally, I think Microsoft is making this much more complicated than it need be. See, HWIDs are going to change.
People upgrade their computers, and parts fail all the time.
The fact that the hardware in any given machine may change over time is irrelevant. What Microsoft wants to know is if one copy of the OS is being used on multiple machines. My HWID now becomes 1011011. A month later, I replace my sound card and primary hard drive. My HWID now becomes 1101001.