I'm assuming that the package reception wasn't signed by the client... so how does Uber prove that they delivered it?
File a case on delivery company to show the proof of delivery and also from Apple's part to report details of the user who activated the phone.
Or just do the same to them. To the Apple store, police, Uber eats. You know what to do.
Pff Apple can't be that stupid .Learn from Amazon . They solve this problem ,long time ago.