That's not inconsistent with what we've seen - they don't neccesarily need to have decrypted it to deduce some of what it contains. All it would take is a reference to a deleted folder somewhere in the filesystem named "Middle East Listing Posts" or some other piece of carelessness to have enough info to leak somethng like this. As for disturbing the flow of Glenn Greenwald's journalism, insofar as it has not already done that by provoking the linked article, it's possible Greenwald wasn't planning to discuss these particular listening posts at all.