On a technical side, it would be much more secure to encrypt the data and send it via the internet than to burn it to media and send it by post or courier. You are missing the point that the CDs were put in the post "by mistake". If they wanted to send them, presumably they'd be able to track them better - at least know when they'd been received rather than "hey where are those CDs... you did what with them?"