Alleged terrorists on witness protection could board flights as their new names had not been updated on the US no-fly list, a watchdog has found.