I don't know how it usually goes, but I'd like this blind spot to be cleared. She published a number, an email address and a nickname on her blog, but no postal address. So the keys weren't shipped.
She never called the number, and can't tell the gender of her perpetrator. Only the neighborhoods acted as mere witnesses of a "group of people" coming in. This suggest that nobody else was involved in the transaction, no friend or neighborhood to give the key and see the guy.
So the guys "came to her house" and got inside, but it doesn't tell us how. Nobody has been in physical contact with them, and the keys weren't shipped.
I don't want to sound insensitive, but this blind spot buggers me a little. Wonder if she can tell more about it, even if it doesn't sound relevant to her horrible experience. I believe her, maybe the key transaction process was bit naive as well and it wouldn't be relevant (hiding the key somewhere), but it could also mean that the burglary might have happened after the host left (while still being an improbable hypothesis, it would just open a new possibility). It's just a small bug that I'd like to be squashed.