USPS "forever stamps" are (still?) being openly sold on Aliexpress and would be even harder to track.
I would love to know how this worked. Is there a hacked credential somewhere allowing for legit, but otherwise unpaid labels? Are they stolen CCs? Something else?
What are the odds that it's just straight up stamp theft? (I don't know what Occam's razor would prefer; your guess is as good as mine.)