What's to say this person did not have a ticket, passport, and boarding pass in another name and destroyed those documents during the flight, which I think is widespread practice for asylum seekers?
That to me sounds far more plausible a scenario than somehow managing to evade security and being missed in the pre-flight headcount.
How can investigators be sure that there was a supernumerary on board? I find it hard to believe they checked the entire flight manifest against passport scans at US immigration, or that such a method would be foolproof.