[Law question reguarding accidental 'hacking']

I received an e-mail from a company saying my address was wrong and they needed the correct address for they could send my prize.(a video game)

I fill out the form, and notice that the prize ID is clear in the url.

Thinking nothing of it, I change the ID to see what would happen and it takes me to the change address page.

I enter my address for that ID, submit it and I'm given a confirm page.

Now I do this a couple of times for different IDs, mainly because I was bored and wasn't thinking.

One week later... a bunch of packages arrive at my door.

Yup, the prizes related to that ID. (I'm assuming)

Now these are not 'small' prizes... more like $100+ items.

I'm almost positive that if an audit is performed... I'm screwed as I'm sitting on over $2K worth of stuff linked to my home address.

So where do I stand regarding the law?

Hacking is defined so loosely, I'm kind of worried...

Do I wait it out, send the stuff back, e-mail the company?

I'm mainly worried about being called a 'hacker' and facing $$$ fines and prison time.

Thanks for any info.