I've thrown the whole, "one per box" idea out the window. It's consistent for the most part, but sometimes that is just totally, totally wrong.
There were 7 boxes at my PR yesterday, one family from my league pulled Giratina X, Shaymin X, Palkia G X, Dialga G X Shayminx X, Hitmonchan, Scyther, (Yes, two shaymin X's)
And on top of that, another hitmonchan, electabuzz, dialga G X, Shaymin X, and another giratina X were pulled that I saw.
I got crap =( But at least I traded for some sweet stuff afterwards.