For three months, a mystery surrounded a winning $6.4 million Oregon Lottery Megabucks ticket purchased Aug. 24 in Bend. Who was the lucky winner, and why wasn't that person stepping forward to claim the prize?

The Bend Bulletin and KTVZ television ran stories about the riddle. The Oregon Lottery Commission discussed it at its Sept. 25 meeting and on Nov. 18 issued a press release.

"Oregon Lottery officials are still waiting for a $6.4 million Oregon's Game Megabucks prize that was purchased on Aug. 24 to be claimed," the release said.

On Dec. 1, however, the winner finally walked into lottery headquarters in Salem. But that hasn't solved the puzzle.

Executive director Jack Roberts of the Oregon Lottery says several things about the winner are unusual. He bought his ticket via the Internet. He was adamant about remaining anonymous. And he doesn't live in the United States—he lives in Iraq.

"I don't believe this has ever happened before," Roberts says.

Lottery rules tell players they cannot buy their tickets over the Internet.

"Internet wagering is a complex issue involving both state and federal law, as well as a number of regulatory, technological and security challenges," the lottery's website says.

Yet the winner told lottery officials he'd bought his ticket using thelotter.com, a website based in Malta that allows customers to buy lottery tickets from around the world.

The second challenge was that the man did not want to be publicly identified.

Again, lottery rules are clear.

"If I win a prize, can I remain anonymous?" the lottery's website asks in its FAQs. "No. Certain information about Lottery prizes is public record, including the name of the winner, amount of the prize, date of the drawing, name of the game played and city in which the winning ticket was purchased."

Roberts says when the winner finally arrived, agency officials weren't sure what to do. "We were kind of stumped," he says.

Lottery officials consulted the Oregon Department of Justice and the U.S. Attorney for Oregon about the legality of a ticket purchased online.

The legal advice the agency got was that the purchaser had done nothing wrong and that if he had the winning ticket, he should be paid.

The winner elected to take his payout over 25 years, and Roberts says the agency made the first payment last week—minus income tax withholding at the maximum rate.

Then there was the issue of anonymity.

The lottery makes the names of winners public in order to be transparent to Oregonians.

But Roberts says the man, an Iraqi national, said news of his winnings would put him in danger in his lawless homeland.

"He's told me about his situation in Iraq," Roberts says. "The situation there is dangerous. If word gets out there that someone has come into a lot of money, bad things could happen."

Roberts acknowledges that his agency always discloses the names of winners, but he is convinced the Iraqi man has made a reasonable case. Oregon's public records law permits agencies to withhold information for personal privacy reasons. The lottery still hasn't made a final decision about releasing the winner's name.

"The personal safety risk that he and his family might face seems stronger than the public interest of knowing who the person is," Roberts says. "I don't want to read that somebody has been kidnapped or killed because we announce them as a Megabucks winner."

Correction: This story originally reported thelotter.com is based in Israel. In fact, the company is based in Malta. WW regrets the error.