1. The numbers are reused, as others have already mentioned.
2. There are instances in which more than one person were assigned the same SS#; one would assume such errors are eventually caught automatically, but then that would be assuming too much
From a programming perspective, beyond all the various privacy reasons of late, using SS# as an index is also bad practice due to that SS# *not* guaranteed to be unique, duplicate issuance, have no built-in checksum, etc.
For some programmers, this may come as a shock ... much like how many seconds are in a minute ... 60 right? Nope, for time critical apps, one has to be aware of leap seconds, which means there can be 59, 60, or even 61 seconds in a minute, but I digress ... this isn't Slashdot LOL!
Ron