We're now close to or already at a stage where large social networks can recognize people from photos with facial recognition even without any context such as mutual friends. Facebook announced recognizing faces without being tagged well over a year ago and we can only expect technology has improved since then.
If someone goes into a witness protection program and gets a new identity then building their new lives, even from the other side of the world, is now potentially at risk. Previously large criminal organizations could possibly have paid off the witness protection program agents, but this is an expected attack vector and I'm sure government programs protect themselves from that somewhat. But what would it take for criminal organizations to pay off some high-ranking Facebook engineers in order to see if there are any recent matches for a number of portraits they supply? Could they reliably restrict access to such lookups even to those on the infrastructure side of things that simply need low level access to databases?
How could or do these networks protect people from abuse of their system?