Imagine you're working in IT or InfoSec for the Russian (or any other state/national) government. You see attacks coming in from IP addresses in another country -- maybe they were successful and you're investigating a compromised host. You find these IP addresses in the logs, do some investigating and find the host that attacked you is running a vulnerable version of sendmail (for example). So you compromise the host as well and, once you get in, you find the previously released exploits and such sitting in a user's home directory.
I don't think this scenario is that outlandish.
Or there's this hypothesis: http://arstechnica.com/security/2016/08/hints-suggest-an-ins...
Which makes a hell of a lot more sense than assuming any of the aforementioned (not least any of the smaller subset of said unlikely scenarios leading to PUTIN).
eg: toddandclair Premise connection is deemed obviously a misdirect, yet Guccifer 2.0's blatantly Soviet era metadata and Cyrillic type is not? I mean, if anything, at least with the Premise connection, they made it 'seem' like a mistake.
And the phishing email in Podesta's inbox, when multiple people already had his password/access to his inbox. So the conclusion is it was the Russians that leaked? Wouldn't it make sense to use Podesta's emails to increase the attack surface size for more targets?? Why would you want to relinquish that access when there was a good chance Hillary would get into power? And then all these other people with access, why couldn't they have leaked it? Hillary's campaign's attrition rate and cynicism was high even within ring of closest advisers. All you have to do is read the human side of the emails to know there are many, many, many, much more likely sources for the leak.