We doesn't need a signed affidavit on GitHub to trigger an investigation.

This already crossed the line of reasonable suspicion. The investigation is where evidence gets collected.

Who knows what other improper behavior these people have engaged in and what other secrets they have leaked, intentionally or by side effect.