With the CRU-email situation, the best evidence is that they were leaked through incompetence: evidence suggests that someone (probably a system administrator based on the file structure) left a giant file prepared for FOIA submission on an open website, and it was snatched up and parceled out.