The way it works in our cluster ones is if it fits in your mailbox they will put it there, you have your own mail key to open it. If it doesn't fit they will put it in the oversized box and leave the key for that inside your mailbox. There's no way someone else can take your package since the key for the oversized box is inside your locked mailbox unless what you're saying is the package delivery box was left unlocked which if so that's awful. Once you retrieve your package from the oversized box you just leave the key in the lock itself. If there's already a package in the oversized box they often just leave it at your front door. But boy that would be a pain in the butt if you had to go after USPS to get the key to open the oversized box if that happened to us
sounds like a headache you had to deal with. USPS has a common problem here (although I haven't experienced it) where they will mark something as delivered but they haven't actually physically delivered it, the common advice is to wait until the next day it'll probably show up then, that's a pain for a lot of people and a lot of posts of "package says delivered but nothing is there" on Nextdoor and whatnot.
