If the person stole the mail that included your card... They have your address information and everything that is on the card including security code.
That may be how? I can't recall what was required to activate a card but it's usually something generic.