Mdthbs

It's also possible that:

The cyanide was in the lipstick. If it is open, the riddle implies that could have been used. Lipstick can be put on anywhere, not just in the bathroom.

Another possibility could be

I'm no chem expert but a quick google search says Cyanide could exist in the air in the form of Hydrogen Cyanide, which could've been added in this case through the humidifier.

Although

Since the humidifier was still running when the room was opened, it would also kill anyone who enters the room too, or at least cause some adverse effects.

Edit :

If the killer was a good engineer he/she could tamper the humidifier to only emit poisonous Hydrogen Cyanide for a certain amount of time, this would ensure that anyone who enters the room later on will not be affected as severely. Still keeping in mind that would leave traces of the poison in the air. But most of it could leave through any openings in the door.

Edit 2:
Nothing to see here, Thanks to @Loong, we know this edit to be pointless.

My friend informs me, The International Standard Atmosphere states the density of air is 1.225 kg/m³ at sea level and 15° C. Hydrogen Cyanide is extremely dense at 687 kg/m³, it would not disperse in the air and immediately fall low to the ground. Rendering the poison ineffective. So there's that theory down the drain.

She was well-known among her friends for chewing on the end of her pen, especially while thinking about what to write. The murderer is obviously a close friend of hers, and the poison was applied only on the very tip of her pen, impossible for the police to find.

I did not read the answers, but I believe that she licked the envelope, and the adhesive layer was poisoned with cyanide.

It's not reasonable to be running a humidifier during or after a shower, as the shower itself will accomplish that function. We may thus find it likely that the humidifier was interfered with. If it was an ultrasonic humidifier, it would form a mist from the liquid in the reservoir. If that liquid were spiked with a cyanide salt such as potassium cyanide, the victim would consume it by inhalation.

Edit: this answer does not account for the locked door, so I consider this to not be a great solution. (It would be cheating to add "and the attacker had a key", since that's against the spirit of the question design: the door was not opened from the outside.)

Another possible answer is:

The poison was planted inside the shower-head. Enough of that stuff gets on you in a shower and you might absorb it through your skin. Or some people might take a gulp of water while in the shower.

You might also want to check:

Any oral hygiene products in the bathroom - toothpaste, toothbrush, mouthwash, dental floss, etc. Many people use those during or after a shower. Generally you spit them out, but you might ingest enough from normal dental care to be lethal if there's cyanide in there. (Also, minty flavor would be a good way to mask the taste of the poison.)