Heartbeats are not logged on a standard configuration, so if people other than the confirmed parties independently discovered the vulnerability, told nobody (or at least nobody who would tell anybody), and then exploited it on systems where heartbeats are not logged (which would be most of them), then how could anyone possibly know?