This is a brutal scam. You do everything right and still get rekt.

Looks to us like an inside job. Probably a USPS employee gets paid a bounty for finding envelopes with checks. Should be easy to verify with AI using check fraud reports in the area of that postal box.