While every piece of mail is not scanned/screened (as you note), postal employees are trained in the identification of potentially hazardous mail, and the US Postal Inspection Service is then contacted to assess the package using their sophisticated forensic equipment:
https://postalinspectors.uspis.gov/radDocs/bombs.htm. These packages tick off a number of boxes in the training that postal workers receive about identifying suspicious mail (excessive postage, weight, irregular packaging, political addressee, etc.).
True, as I noted myself. But why then is the media calling it an "attack"?
No functioning detonation devices have been reported. The pictures I saw were of two of the bombs. I saw them separately on Fox and CNN broadcasts. I tried to find the footage that I saw, but was unable to locate it for you quickly. One picture was a of a sealed pipe with wires. There was nothing attached to it. The other (which was sent to Brennan at CNN) was a sealed cylinder (didn't look like a pipe) that had an electronic timer attached to it, but it has not been claimed that the timer was powered or running. What I was looking for in these pictures, since these were not tripwire or mechanically activated bombs, was a power source, or evidence that they were powered. I didn't see any. While I agree that bomb experts would remove trigger apparatus from the bomb, I also believe they would photograph all of the components if they intended to publish what they found. The significance of this is that, if I'm right, the bomb maker knew he was sending non-functional bombs. That's a pretty sophisticated act for a terrorist, because he bears all the same risks or being caught and charged with the same crimes, but he does no damage.