And since it is technically impossible to recreate such CDs from one original copy, this must be taken as proof that the copy is legitimate?
Which type of answer do you actually expect? If you buy computer hardware in a shop, and you want it repaired under warranty, you need a legal document showing that you bought the hardware. It is commonly accepted that a receipt will do so. So, the "legallly correct way" to ensure that you own a 3.9 copy is: Have your receipt ready. Is this good enough for you?
Now, this, of course, makes it rather hard to verify ownership by technical means, right?
So, what else should I do? I'm not spending my day verifying Os 3.9 receipts. I can only, by all the means I have, tell people: Please, have your 3.9 ready, get the original files from the CD, then appy the patch. That is as much verification I can do, without too much hassle.
Apparently, asking people to be honest seems to be asking too much these days? Oh, right, I'm talking to a lawer, that's why....
Once again: The shell patch is only for owners of 3.9. This is not a free distribution for everyone. If you want 3.9, go buy it in a shop. Got it?