If the disgruntled staff member simply copied the code over then surely there would be no way to track down who it was? Even if they found a staff member had accessed tonnes of source code before they left, how could they prove it was that person who leaked it?
I mean, if they went after someone civilly, Twitter doesn't have to prove beyond a reasonable doubt, only that there is a 51% chance it happened.
So proving that someone downloaded all of the source code right before the leak would be pretty strong circumstantial evidence. It's not impossible to prove it just because you don't have a smoking gun.
