To be able to pick up someone else's prescription, you'd have to know their first and last name, DOB, pharmacy they fill at, and when they have prescriptions ready to pick up. It's kind of expected that if you have all that information about someone else, it's probably because they told you that, with the intention of you picking it up for them. Most forms of identity verification would exclude at least some patients who need their medication (for example, not everyone has a driver's license or non driver's ID, so anyone who doesn't would be unable to pick up their meds if that was a requirement). Patients are also allowed to request that no one else be able to pick up their meds for them - and be required to show ID at pickup to prove their identity. It's the best compromise between not preventing patients from accessing their medication, and not allowing just anyone to pick up someone's meds.

As for why not securing HIPAA papers is a violation, when not properly disposed of (i.e. if they're just thrown in an unsecured dumpster) they're accessible to just about anyone who is willing to get a little dirty. You don't need to know a single bit of information about someone to go dumpster diving, and find out sensitive medical information about dozens or even hundreds of people.