These sorts of things are always NP problems. If you know the answer, in hindsight it was obvious, because all the signs line up. But to think to look at the answer, to search the entire space of how to discredit someone, that takes resources.

Everything Bezos tells about seems to have happened very recently, after the divorce announcement, making Lauren Sanchez a very obvious hacking target for which password leaks are a very obvious easy strategy.

Taking on Amazon cybersecurity could be a job for the likes of the NSA, but accessing a cracked phone without being caught is almost amateur level hacking.

The spam comment on that post is entertaining.

When was it put there? Before or after the data was stolen?

From GP's link: I find that her email addresses have been included in that recent dump of 770 million accounts called "Collection#1".

For background, see Troy Hunt's explanation for this data [0]. He certainly didn't add Ms. Sanchez's passwords to this. The MEGA uploader could have, one supposes, but that pushes the timeline back to early January. The idea that someone was sitting on all these creds (140M email addresses in this breach that HIBP has never seen before.), and then released them as a smokescreen for Ms. Sanchez's would be, let's say, conspiratorial.

[0] https://www.troyhunt.com/the-773-million-record-collection-1...