I assume there's a list of valid PO boxes provided, much the way addresses are taken off of a list somewhere, addressed to "Current Resident", and delivered that way though the mail was not only obviously mass spam but not even addressed specifically to the resident.

US Postal makes money delivering marketing materials from local businesses (supermarkets and the like) to P.O. Boxes. They also offer no way to let you opt out of this.