I propose the angle of looking at it via the leaks themselves. That list left us with somewhat of a dead end.

Example:

Leak: Screenshot
Culprit: Vincent WA (decode)
Method: Server Access
Solved: Yes (message codes work)

Leak: Member Workplace
Culprit: Attendee To X Event
Method: Conversation
Solved: Yes (infosec guide enforcement in effect)

Leak: VE Address Site
Culprit: Uknown
Method: Unknown
Solved: Uknown