1. If you have been notified that a puzzle is rejected, whether that notification be via e-mail or your SASE, all rights have reverted to you. Some editors (and I confess to having been one of them) may take a long time to reply either way. That's why you should not submit a puzzle to a second market before learning its fate at the first one.
2. The SSN request is so the publisher can associate your pay with a number for year-end tax reporting (i.e., form 1099). Is the risk of ID theft greater than 0? Mildly so, I guess, but that risk wouldn't be associated with the publisher or editor, it'd be some miscreant opening envelopes at random. You could reduce the risk further by taking your envelope to the post office rather than leaving it in your mailbox for pickup.