So to more directly address "why it's in the triplet" we have to look at the most common ways that systems with multiple outbound SMTP addresses use their mail servers. A hosting group like GoDaddy will usually have a number of hosts feeding a single server, and that server will have a queue of outgoing messages. While there will be multiple servers, on multiple IP addresses, each server will have its own hosts and its own message queue. If a message is refused for greylisting, it is still queued in the same mailserver at the same IP, and so will be tied to the same IP the next time it's tried.
GoDaddy may not be the best example there, because in fact they seem to have a round-robin queue that selects among three or more Internet-facing servers for any message coming out of an intermediate server. However, although I can't be certain, what I've seen of their output emails suggests that a temporary error will not result in that message being pushed back to the intermediate server; it's the Internet-facing server that has received the temporary error, and is managing the holdback timing. So the message is still tied to the same IP address, because it's been left in charge of a specific server.
The specific case that greylisting was initially designed to trap, the infected home machine, will of course simply not try again after the message send has been attempted, and may in fact be already disconnected and off to the next server when the error message comes back - if the spammer doesn't see that the message was refused, he can probably still charge for having sent it, and those $0.000001 per message can add up.
And the subject is not really a valid key for greylisting, partly because there can be a large number of different, valid, messages with the same subject, and partly because Joe Spammer will be sending out a crap-ton of messages with the same sender and subject, from different IP addresses, in hopes that some get through.
