I recently went to the United States Postal Service’s web site to request that they hold my mail later this month. The site makes it easy and quick to request the service. This is done in part by doing nothing to assure the requester’s identity. All you need to know is someone’s name and address and you can have the local post office hold their mail. This is distinctly different from submitting a change of address on the site; that requires a credit card. It at least allows a check to see if the requester has lived at the address. There is no such check to hold the mail.
This is just asking for someone to exploit it.