I agree that the accusations (that I saw) tended to be tentative. To the extent that people were explicitly tentative, less harm is done.
Even if someone said "I'm 99.999% sure this is one of the bombers" there were others to comment, "I don't think we can be that sure."
For instance, I think it may have been in this thread that someone posted a picture of two women standing behind the barricade next to a mailbox, with a package on the ground in front of the barricade. Another photograph showed that this was the location of one of the explosions, and the (I don't remember how tentative) conclusion was that it was probably the package in the photo which exploded.
Other people were quick to point out that the explosion seemed to originate further back in the crowd.
As far as the Ricin arrest, I'm not sure your point. Even if the impersonator should not have been arrested and questions and the police blew it, that has nothing to do with whether online sleuths did something they shouldn't have.
The actions of the police can be judged for themselves, and the actions of online sleuths likewise. One doesn't get to claim that their actions are better because someone else did worse.
I guess my point is that there is a range of harms which might be caused by casting suspicion on an innocent person.
At one end of that range is someone who is accused, tried, convicted, and executed for a crime he didn't commit, followed closely by someone who is not executed but spends the rest of his life in prison. After that, people who are convicted and spend years in prison before being exonerated.
Somewhat lower are people like the Duke rugby players who are arrested, tried, and acquitted.
Then I'd put the Elvis Impersonator, who is arrested, questioned, and released without trial.
The internet sleuths are not authorized to arrest anyone, so their suspicions are given only the weight that the evidence they cite deserves. We saw lots of people with backpacks, and each time one was circled there were people asking if anyone could find pictures of them without their backpacks. One of them appears to have removed his backpack (and likely stood over it) to watch the race. We know that several backpacks were left behind in the panic after the explosions, but to my knowledge none of the people who were implicated by internet sleuthing were ever shown without a backpack after the blasts. If such a picture HAD been found, it would undoubtedly have strengthened suspicions against an innocent person, and under other circumstances that person might even have been the subject of official scrutiny.
In this case we know that one of the hospitalized victims was able to tell investigators that the the bomb which injured him was placed mere seconds before it exploded. That narrowed their need to examine surveillance video considerably, and they were able to identify two solid suspects within a couple of days. It's unlikely that they ever gave much scrutiny to anyone who was suspected by the internet sleuths.
Under other circumstances, though, where the bombs may have been placed minutes, hours, or days before they were detonated, they might not be able to settle on suspects so quickly. Internet sleuths may implicate innocent people with credible suspicions, and some of those innocent people may even be hauled in for questioning. Since cases can be built which will result in the conviction of innocent people, someday it may happen that internet speculation leads to an innocent person being convicted of a crime.
If that does happen, I think the prosecutor and judge/jury will be more responsible for the harm than the internet speculators. They're the ones who have to make sure evidence meets the standard of "beyond a reasonable doubt". People who post opinions on the internet have no requirement to meet that standard, and their opinions should be weighed with that fact in mind.