If the 4L can be poured somewhere else, it gets even easier:

• fill 5L can
• pour from 5L into 3L. 5L now has 2L left. Pour that somewhere.
• repeat above once more to add another 2L.

It depends on what type of VPN you have as well, because if you have one that gives you a dedicated IP, chances are it wouldn't be detected. But most of your regular cheap VPN packages will have you sharing the same IP as hundreds (thousands?) of others.

tears out hair

I don't think it's just streaming services. FTC quotes gym memberships as an example as well, and they're notorious for bad cancellation policies.

Good question. A lot of banks in Europe use this type of setup, where it will ask you for 3-4 characters of your pin/password, both to login and to confirm transactions. I always thought it was weird but never thought about the security implications.