How can a bank satisfy the CIP requirements if they open accounts by mail? How can getting a copy of the person's IDs be sufficient, since the bank cannot verify that the photo on the ID matches the person? I understand that the bank will then have to do some form of non-documentary verification, but how can we know that the "customer" hasn't stolen the identity from someone else?

You can't. That is why you build in whatever checks and balances are possible and you decide if the risks are acceptable to your bank and will be understood by those who review you.