Comment by jarcoal

It's a little hard to parse parts of that paragraph, but it sounds like the repo (presumably hosted on GitHub) had access tokens granted to third party integrations (similar to Heroku being granted access to GitHub on behalf of their mutual users).

Assuming that's true, it should be trivial for GitHub to tell them which third party integration the token was associated with.