[DannyTN]

I'm guessing:

• They knew where the package was mailed from by the postmark and the date/timeframe.
• Probably got the perp on camera mailing it, possible license plate.
• Simple identification and arrest.

But it's also possible he was already on a watch list. Maybe he ordered castor beans, downloaded a recipe for ricin, made a threat online, talked plans to someone who had reported him.

[Grimmy]

But it’s also possible he was already on a watch list. Maybe he ordered castor beans, downloaded a recipe for ricin, made a threat online, talked plans to someone who had reported him.
*************************************

Or, answered the Craigslist add.