In my experience they only check the email. Considering that domain registrars operate on razor thin margins I doubt they would bother sending snail mail to validate addresses, for instance.

This is the whois privacy model used by many registrars already. The one issue is that ICANN then views the registrar as the rightful owner of the domain, which could cause issues with e.g. a registrar bankruptcy if the creditors decide to make use of that to sell off domains.

In my experience only phone numbers and email addresses are verified, and only on initial domain registration. Post registration I get regular "ICANN verification" emails which all pretty much say to only act if there's incorrect information.

With the exception of the .nyc TLD I've been able to use a PO Box and a forwarding phone number for registrations across registrars for years. .nyc provided no way to demonstration the required NYC nexus except for the postal address to be a physical building in New York City so I let that domain lapse.

To some extent they seem to do. For instance I had forgotten to update the WHOIS record for phone number when my number had changed and after some months I started getting reminders whenever I logged into my registrar's site that the phone number was not reachable and that I need to update it. But no emails, and certainly no paper mails regarding this. But no enforcement. Nothing happened even though I dragged my feet updating my phone number for a considerable time.