Yeah so the existence of URLs for specific retailers like Lego and Adidas suggest to me that they ordered from the shipper, got their account number, then just

Yeah so the existence of URLs for specific retailers like Lego and Adidas suggest to me that they ordered from the shipper, got their account number, then just got a botnet to enumerate (or randomly query) with different package identifiers.