A security researcher claims the US Postal Service ignored a security flaw affecting 60 million users, until it was contacted by a journalist.