The "ID number" field is not enforced unique. I've often wondered why and presumably it is for this exact scenario - your data comes from different sources which have their own IDs and you cannot expect them to have a common index of id numbers - they will have their own systems and they may well overlap. 

Withing Moodle/Totara the user records are usually referenced by a unique id field which is not the same as this "ID number". 

The username is also unique and in the CSV file for Totara Sync it is the only unique field. I'd be interested to know what happens when these overlap between your external vendors... in fact I think I'll add that to my list of things to test myself!