In the article:

> "Upon reviewing our products and code, the HTML comments shown in the screenshot that are referencing newrelic were not injected by New Relic's agents. It appears they were added to the website by its developers."

> [Coin Hive] did confirm to us, however, that the email address used to set up the account was a personal one, and was not an official CBS email address, further suggesting malicious activity.

Yeah, it was obvious it was never NewRelic. But it is not obvious if it was a contractor, and employee, or someone who gained access through other means.