Assuming that you're in the US you're considered innocent until proven guilty. If you didn't order it and never took possession you haven't broken any laws so there's nothing that they can even charge you for let alone prove that you are guilty of anything.
However if you were to show up and try to take possession and/or contest the confiscation that might be considered an acknowledgement that you did indeed order it even if they haven't any proof of that right now.
Who knows what is going on. It could be a scam or maybe they came across your address and are fishing to see if they can get you to bite.
The part about "The letter said I may have “civil penalties” that may be sent to me in a different letter." makes me suspicious of someone trying to scam/intimidate you into paying them off. This reminds me of the automated messages that I get on my phone from time to time warning me about how they "have an arrest warrant out for me" and how I need to "contact them immediately and pay them off" to make the make believe charges go away.
I'd ignore it. You probably won't hear anything again and if you do and have concerns that it could in fact be legitimate you've already contacted an attorney that can deal with it. The biggest concern that I'd have is the possibility that you got on someone's radar and that they may be monitoring your address for future deliveries but given the millions of packages going through the postal system daily that seems like a bit of a stretch.
We've got people out there dealing in hundreds of millions of dollars in drugs. The government simply hasn't the manpower nor the motivation to try to chase down every guy buying small quantities of anabolics for personal use.
