WIV had recently published research on, and had an active grant to perform (at the time of the outbreak), chimeric Coronavirus research, and they were one of the two world leading labs in this. In that research, they were transplanting the spike gene from one virus to the "backbone" of another. You could call this "engineering" or "gain of function" depending on your perspective.

The thing that raised people's suspicions about this is that the spike RBD strongly resembles a virus sequence they released recently (Pangolin-CoV), and the backbone strongly resembles another virus they recently published (RaTG13). That suggests that there was some sort of recombination event. That recombination could have occurred in nature, in an animal that was simultaneously infected with two viruses, or it could have occurred in the lab.