If there’s not a bylaw allowing the careless resident to be charged the cost of rekeying the building, then there needs to be.
And specifically mention that storing keys in the letter box, or anywhere else that’s essentially unsecured is not permitted. Basically put the onus on the key holder to prove they took appropriate care of the keys. And a police report for even a minor crime where keys are taken.
All in the name of getting evidence from the person that their actions were careless.
It might also be time to consider using electronic keycards which can be cancelled as soon as their loss is reported.