[jsheard]

GitHub allows enterprise customers to run their own GitHub instance on-premises, so any one of those could have peeked inside the VM and pulled out the source code.

https://enterprise.github.com/faq