There's a difference between getting 30 AA cards from 1) mailers in your own name, 2) using other (real) people's mailers, and 3) creating AA accounts for non-existent people to get more mailers. I would have drawn the line at using mailers not addressed to me. I'm happy to get 30 AA cards as long as the mailers were in my own name. And Citi/AA can't really do anything about that aside from tightening up approvals and/or bonus eligibility going forward.
But using mailers not addressed to me is going too far, even if it's a real mailer to a real person, because they're technically non-transferrable (whether given to you by a relative or obtained by dumpster diving).
Making AA accounts to generate mailers to fake people is definitely going too far and is borderline fraudulent. Using other people's legitimate mailers is not fraudulent but simply a violation of the non-transferable terms.