They have a couple of options. First they can try to get records from the companies selling the cigarettes that are being delivered to PA. It can get complicated, especially if it is a company that operates on an Indian reservation.
Another option is to go after the companies that deliver them. Usually that would be UPS or FedEx, but EVERY delivery company that I know of will cooperate with law enforcement. Theyd tell them that illegal cigarettes are being shipped from this company and being delivered into our state in an attempt to circumvent tax laws. Now tell us where deliveries from that company have been made in PA. Usually cigarettes/booze require a signature so there will be a delivery record with your signature on it.
The problem with that is the shipping label of a package from that company does not usually describe the contents just that it doesnt contain hazardous materials or prohibited items, etc. So you could always just say you ordered some non-cigarette item, or only one carton.
At that point theyd probably note the address and request that packages to that address (shipped from that company) be intercepted next time. Theyd open it and see that it did indeed contain 10 cartons of cigarettes, tape it back up and have an officer posing as a driver deliver it and get the signature then theyd have you.
They routinely do that type of thing regarding items purchased with stolen credit card numbers. Id think theyd have enough to do without spending a lot of time doing this unless you were ordering a ton of cigarettes.
I personally don't think they would take the time to do this. But how do the online cigarette sellers get their cigarettes? That's bulk. Wow. This might shake up a lot of people.