It seems that the leak originated from 4chan [1]. Two people in the same thread had access to the weights and verified that their hashes match [2][3] to make sure that the model isn't watermarked. However, the leaker made a mistake of adding the original download script which had his unique download URL to the torrent [4], so Meta can easily find them if they want to.
[1]: https://boards.4channel.org/g/thread/91848262#p91850335
[2]: https://boards.4channel.org/g/thread/91848262#p91849717
[3]: https://boards.4channel.org/g/thread/91848262#p91849855
[3]: https://boards.4channel.org/g/thread/91848262#p91850503