I managed it by asking United about it, who responded saying that the ticket didn't correspond to what I was talking about, and telling me I had the wrong ticket number (despite the fact I specifically mentioned the flight having been flown in 2015). Being United, they did in fact give me the full name of the person who currently owns that ticket, so I could theoretically look it up now if I wanted. Definitely a security hole there.

I haven't been able to find out any information on what the form number and serial number are - did a bunch of googling with nothing useful. Is that just decided by the airline internally?