It's extremely straightforward: they value customer satisfaction considerably above their own fraud write-offs. That's literally it. It's a bit silly, because there are a number of measures the CSRs could take to prevent someone with JUST your email, address, and name from accessing your account (Netflix asks for a "call in code" visible when you're logged into the site, for instance), but they don't.

The CSRs are in India and basically told to satisfy any "did-not-arrive shipments". The fact that they are also willing to ship to an alternate address is completely insane. But my scammer told them they were "on vacation" and appealed to that side of the customer satisfaction coin.