One thing that gives away that atleast the second bomb wasn't in a mailbox and that the bag in that photo isn't the bomb is if you look at the guardrail right behind the mailbox. if the bag or mailbox was the bomb, the mailbox would be gone, but being infront of that rail it would of blown it back towards the building, but if you look close you can see that the guardrail is actually bent around the mailbox, which would imply that it came from the crowd, i would suspect by that black fence.

I know you're following the news updates, i'm just tryin to keep it level with what i'm hearing here because some stuff, like that bag for instance, the media had an itchy trigger on and said that must be the bomb without looking at anything else around it.