They could just hack their devices remotely, or physically break into his residence. I suspect a serial leaker will lack neither the discipline to not copy data onto personal devices, nor the opsec to withstand a motivated nation-state, since a lot of the work seems rushed, and is off playbook.