So far, the MAC seems to be the only known "stable" way to identify a device.
Have a look at Erica Sadun's UIDevice(Hardware) category, you'll notice that the only useful thing for identification is the MAC.
She also has a UIDevice(IOKit_Extensions) category which does provide IMEI and serial number. However, IOKit is private API. Erica wrote:
As iPhone evangelist Matt Drance tweeted, "IOKit is not public on iPhone. Lack of headers and docs is rarely an oversight."
So using IOKit might get you rejected.
As far as I know there is no way for a user to change the MAC without jailbreaking the device (and then he can do anything he wants anyway). So my suggestion is to ignore the jailbreakers and simply use a UUID based on the MAC.
Warning! MAC address APIs will not work in iOS 7.
