Hi ​@MW2024, welcome back to the community.

Trying to tackle these one at a time here: 

How can we ensure that each customer only receives these emails once per year, regardless of how often they change their birthdate?

I think you’re on the right track with using the “Has not been in this flow in the last 365 days...” - this will, by definition, prevent someone from getting the same Flow within that timeframe.

Does updating the birthdate field actually retrigger the flow?

Assuming you’re using a “Date Property Triggered Flow” - then yes, the date will always trigger the Flow.  There’s nothing particular special about a “Birthday” to Klaviyo - it’s just another date in Klaviyo system so it won’t inherently know not trigger a Flow in the same year.   But of course, Birthday’s are special to us humans! :) 

What filters or best practices would you recommend to prevent abuse while still maintaining a positive customer experience?

I think your filter of preventing someone getting in more than once in 365 days is a reasonable first step.  You can also create a Flow triggered whenever someone changes their birthday (assuming it’s a Klaviyo Signup Form) so that you can send a confirmation email to them that their birthday is updated, but they will only get one birthday discount every 365 calendar days.  That is a polite way to say, we know sometimes we make mistakes with Signup Forms (especially with autofill tools, etc), so we updated your birthday but if you’re trying to game us, it’s not going to work!  That way it is both acknowledging the edge case when someone did in fact put in the wrong birthday (so you’re not accusing anyone inadvertently) and warning those that are trying to abuse your generosity.  

Hope this helps!