Do you think the NSA wouldn't have checked access logs and the emails if not for the scan? The difference isn't between getting caught vs. not, it's between getting caught in days vs weeks.
But also caught with irrefutable proof. The printer and job time can be tracked back to her precisely. With that in hand, there is absolutely no doubt that leak came from her (she intentionally shared), or through her (she printed, but someone else shared, with or without her knowledge).
