No doubt this is happening to some extent. But it does appear that the USPS requires valid residential addresses in order to send a mask. The USPS does have a database of actual addresses that they validate against. You can't simply send to something that looks valid.

Perhaps some good citizen hacker created a bot that automatically submitted a request for every address in town.