Our identities are secure unless we post personal information about ourselves.
As an example, if someone were really serious about finding me they could. My profile shows the small town I live in. My posting history reveals bits and pieces of my personal experiences. Someone with lots of time on their hands could eventually figure out who I am if they really were motivated to do so.
With Buckhead the the Times was extremely motivated to find out who he was. They put 2 + 2 together and then more than likely called the person they suspected to be him and asked him if it was him.
Key loggers, following some links from FR to other sites, also seem possible as means to discovering irl names on the Internet.