How does salt and water promote corrosion?
I think a tantalising clue can be found in the principle of cathodic protection used in industry.

Cathodic protection is used in the shipping industry to prevent iron/steel hulls from rusting. Essentially you make your hull into a cathode by connecting a (typically) zinc anode to the hull. How do we know the ship's hull is the cathode and zinc the anode?

And zinc in fact?

Lets go back to the standard reduction potential tables. The following reaction has a reduction potential of $\ce{-0.7618V}$:

$$ \ce {Zn^2+(aq)} + 2{e}  \ce{-&gt;} \ce{Zn(s)}  $$

Whilst the following has a reduction potential of $\ce{-0.44V}$:

$$ \ce {Fe^2+(aq)} + 2{e}  \ce{-&gt;} \ce{Fe(s)}  $$

Clearly the rusting process works in the opposite direction (and thus so do the above equations) which just means we reverse the voltage to get the oxidation value. 

A higher reversed voltage means that that process has a greater tendency to occur, which means that zinc here is preferentially oxidised over iron. Hence if we connect an iron hull to a zinc rod, the zinc acts as the anode whilst the hull is the cathode i.e any $\ce{Fe^2+}$ directly formed by reaction with sea-water is pushed back to iron metal by the production of $\ce{Zn^2+}$, a process which liberates two electrons. 

This should suggest that some electrolytic process contributes to salt water affecting the oxidation of iron. The most basic explanation is that the sea water acts as an electrolyte, which facilitates this process much more easily than, say, distilled water. 

What does this mean however when we don't have an electrochemical cell as above, and only have a single electrode i.e. the ship's hull? 

We might like to look up the standard reduction potentials for both chloride and iron, however we quickly see that this isn't the case; both chloride and iron metal have to lose electrons in our case, which isn't going to form an electrochemical reaction. 

It's an interesting case that bleach (alkali salts of chlorite, $\ce{ClO-}$)undergoes the following reaction with iron:

$$ \ce {Fe(s)} + \ce{ClO^-(aq)} +\ce{H2O}  \ce{-&gt;} \ce{Fe^2+(aq)} + \ce{HClO2(g)} +\ce{2H+(aq)}  $$ which has a favourable overall voltage of around $\ce{2.11V}$.

So we've seen that chloride doesn't directly react with iron, but chlorite does. This is a possible route for corrosion, although it's not obvious by which natural process chlorite comes about. 

Another point to note is that seawater just doesn't contain sodium chloride, but myriad other ions which can contribute to this corrosion process,especially sulphate. 

$$ \ce {SO4^2-(aq)} + \ce{4H^+(aq)} + \ce{Fe(s)}  \ce{-&gt;} \ce{Fe^2+(aq)} + \ce{SO_2(g)} + \ce{2H2O(g)} $$ which occurs with a total voltage of $\ce{0.61V}$, which tells us that the chlorite process is much more favourable thermodynamically. 

So in conclusion, there are many different reactions that can utilise seawater to oxidise iron—it's not incredibly clear which ones do contribute, and which ones don't, but the above provides the means for some educated guesswork, so to speak. 

As a final point, iron can oxidise in air without water, it just takes a long time. The presence of an electrolyte will speed up the process however. Corrosion also needn't be a reaction with oxygen either, but any process which makes iron ions from iron metal.