Almost four years later, investigators say they should never have had access to nonprofits' private tax information