If there is no evidence of breaking into the blue mailboxes, then it’s a postal employee that is taking them and probably selling them or passing them on to an accomplice who does the actual forgery.
It may also be an employee of a postal contractor or temp/part timer worker. The kind that gets moved around to cover for regular employees taking vacations or sick days.
Spreading the thefts over multiple facilities makes it harder to spot the pattern.
Drop boxes have been broken into on the streets. The crime ring has operated in Chicago, and suburbs such as Lincolnwood, Niles, Park Ridge, and the exurb Naperville in a neighboring county. Some postal workers were arrested in Naperville.
In the olden days, checks were hand processed and alterations were easier to spot. Using technology makes the work of scammers easier. Many of the forgeries are so obvious with white out or correction tape being added to the checks.
It also makes me wonder about election security based upon signature verification as judged by computers with the dials turned to zero so as to pass anything as valid.