Its also the top 3 on other non covid website like the DEP of commerce -

https://analytics.usa.gov/commerce/

You can get a JSON of the data also and see they have “ZZ” and “not set” as two cities excluded from the front dashboard. https://analytics.usa.gov/data/live/top-cities-realtime.json

No doubt this is happening to some extent. But it does appear that the USPS requires valid residential addresses in order to send a mask. The USPS does have a database of actual addresses that they validate against. You can't simply send to something that looks valid.

Perhaps some good citizen hacker created a bot that automatically submitted a request for every address in town.