I'm not sure precisely how bullets are handled in terms of where and how they're allowed to be shipped, but they are handled differently from guns. Things actually get a little bit wonky in terms of definitions in the US, since a gun is composed of many different pieces and the only one of those that's actually considered the gun is the receiver (which is actually one of the simpler pieces and one of the easiest to manufacture). As far as I know the chamber, barrel, bolt, etc, can all be shipped without any issues, as they're not actually considered a "gun", while the strict regulations apply almost exclusively to the receiver.

With regards to the Batman shooter I'm not sure just what he ordered online- it could very well have just been the tactical gear he was wearing and not any of the weapons he used.

He ordered a lot of ammo online, way more than a normal person could carry or use at once, so it's a non-issue, you can buy a ton at sporting goods store too, don't think anyone would ask, even if they did any cockamamie excuse would do. I don't know if he got any of his guns online but it's actually easier to get them from a local shop and there's plenty of those. Everyone uses the same background check system, so it doesn't really matter where he got them, if he bought them legally at one place, any other place would have sold the guns just the same.