They can pull it if they have PP to do so. You can write EQ/EXP/TU and ask them to provide you with the PP given prior to the pull. They usually charge a fee for this.
Too many would be like 4 times a week. 4 times a year would not.
If you owe a debt they have PP. However, if you sent them a timely DV and they keep pulling they are in violation of the FDCPA if they have not responded. If it was not timely they are not.