They were identified from surveilance photo's released about 80 hours after the bombing, allowing for ample time to escape the area, should that have been their intention. IMHO, these morons expected not to be noticed as "out of place" since they lived only a short distance from the bombing site, thus they had no plan B. The carjacking occured after their photos were aired, so their identities were already known, just not their immediate location.
The biggest mystery, to me, is why, after having been interviewed by the FBI in 2011, they were not in a criminal/immigrant database that could be quickly matched by using face recognition software. Had this been done then they would not have been tipped off by publishing their photo's (simply to get an ID), as their names (last address and known associates?) would have been known.