Why is two out of three enough?

Because people are not always reachable. Requiring all three would mean one unanswered phone call leaves a genuine delivery unresolved forever. Two independent confirmations is enough to be worth something and achievable in real life.