Social insurance numbers are stolen by the millions — but Ottawa replaces just dozens per year