Well, banks seem pretty happy with the safety of USPS for sending cards, so how about sending the person a letter with a one-time code?

The multi-day delay even sounds like a good idea, in case someone triggers that system with the intent to steal mail -- it gives the still-able-to-login real user time to veto it.

(If you want a level of anonymity, you can rent a PO box, use a commercial mail handling agent, register c/o a lawyer, etc.)