US investigators overstated the strength of scientific evidence against a man accused of sending letters laced with anthrax, a review panel has said.
But the National Research Council did not dispute the conclusion that government scientist Bruce Ivins was responsible for the attacks.
The panel said scientific evidence was "consistent" with that result.
The attacks, weeks after the 9/11 terror attacks, killed five, including two postal workers in Washington.
"We find the scientific evidence to be consistent with their conclusions but not as definitive as stated," said Lehigh University President Alice Gast, who led the panel.
The letters containing the lethal germ were posted to cities across the country. In addition to the five killed, 17 people were made ill.
Ivins killed himself weeks before he was to be charged.
In a statement, the National Research Council said that advanced scientific methods alone - in isolation from traditional investigative methods - were insufficient to trace the source of the anthrax used in the attacks.
The review was carried out at the FBI's request.
The FBI said in a statement its investigation had not relied only on scientific findings.
"The FBI has long maintained that while science played a significant role, it was the totality of the investigative process that determined the outcome of the anthrax case," the agency said.
In 2008, investigators said Ivins, a researcher at the army biological weapons laboratory in Fort Detrick, Maryland, was the sole person responsible for the deadly anthrax attacks.
Ivins killed himself that August, shortly after investigators told him he would be charged.