[mothered]

After you ship the package, please reply to this email with the tracking number. Having the tracking number on hand lets us issue your new order as soon as your package arrives at the warehouse.

The vulnerability here Is the tracking number. Do some research on (or If you already know)  the context of the tracking number, and see how It's formed- Identify the number and type of chars etc and formulate one that's based on a similar algorithm.

Then tell them you've already shipped the Item under a given tracking number. Obviously It will not exist, but that's the point of the SE. They cannot prove otherwise. As far as they're concerned, you've shipped the Item and given they can't locate It, hence you may well get a replacement sent to you. As with every SE, there's always an element of risk. Be aware of that.