[disillusioned]

It's extremely straightforward: they value customer satisfaction considerably above their own fraud write-offs. That's literally it. It's a bit silly, because there are a number of measures the CSRs could take to prevent someone with JUST your email, address, and name from accessing your account (Netflix asks for a "call in code" visible when you're logged into the site, for instance), but they don't.

The CSRs are in India and basically told to satisfy any "did-not-arrive shipments". The fact that they are also willing to ship to an alternate address is completely insane. But my scammer told them they were "on vacation" and appealed to that side of the customer satisfaction coin.

[gambiting]

Yup. I had the same thing with Logitech - my mouse broke while I was visiting my parents in an entirely different country, and they sent me a replacement there, without having to send the old one back. I just explained I was on vacation and it was fine,they just asked me to give them the new address.