They've "fixed" the loophole by sending you a physical letter with a pin number that you have to input onto their website to activate the service. However, someone that's targetting you could still steal your mail with the pin.
Negative, I just activated it and all I had to do was answer some questions related to my credit.
Is the address you activated it for on your credit report? They likely verified your identity through those questions, and would also have your current and past addresses as part of that.
Unless they changed it very recently you can still sign up completely online or have them mail you a PIN. They do still mail you a PIN no matter what so you can at least deactivate it if you didn't set it up.