You have people phoning up UPS finding out the addresses of where packages are going, and potentially writing down the address if it turns out not to be theirs.

You can see from the tracking results on UPS that UPS are leaving a lot of these on the steps of residences and thus if you setup the correct monitoring you now have the possibility of people running around to the houses of freshly delivered laptops to take them from the door step.

Additionally, where people have signed for them, their last name is listed and with the addition of the zip code from the original source this creates further concern. I've already been able to find out the identity of someone who received one who lives in my zipcode because he has an unusual last name. I just searched for their last name + zipcode on Google and could confirm he is a developer at Engine Yard.

The weak points in the chain are that UPS assumes you must be one of the authorized parties if you have a valid tracking number in hand, and so when you call up to enquire they take that as validation.

What this really comes down to is how these tracking numbers + zipcodes became public in the first place (http://news.ycombinator.com/item?id=1996623)