Except the mailman would also need to somehow get your personal login to go with the one-time pad. Oh, and there's an activation code for each pad which mailed seperately too, so he'd need that as well. It really is quite a secure system. Granted, nothing's going to be 100% when not dealing with things in person (and not even then for that matter), but I think it's about as close as you can get.
So for example, assuming the mailman really did want access to your online banking account, he'd need to:
A) Intercept the key card, which is not credit card sized nor made of plastic (though it is thinly laminated) and so isn't readily identifiable in an envelope.
B) Intercept the activation code, which is in a different envelope sent at a different time, and is simply a scrap of paper with some alphanumerical characters on it.
C) Get a keylogger onto a computer you use to access your online banking, tax returns or whatever, and grab your personal login.
D) Pull all this off before you start wondering where your new key card is and call to have it blocked.
Alternatively replace A and B with stealing an already activated key card, in which case he'd have to be very fast indeed in grabbing the money since it only takes a phone call to block it. And he'd still need to do C. And of course he'd need to know which bank you use, but being the mailman I think we can assume this to be true.
And as for ID theft, the key cards being one time pads basically rules it out. Yes, if you went through the steps above you'd get access to some personal information, but the moment the key card is blocked you lose access, and there's nothing you could do to prevent the correct owned from regaining control. He simply gets a new key card, and he's back on top - And you can't use the key card to change the address new cards are sent to.
[Edit: Added example]
