Those leaks usually spring from low level sources. QA testers, PR firms, event organizers, recruiters, interns, contractor portfolio's, distribution channels, retail etc.
A lot of publishers also do a show and tell, where they share what they're working on with the other teams.
This is very common for the big bois like Embracer and Ubisoft.
Seldom do developers leak since that is the end of their career. It's almost never the 'games' that leak, only trailers, promo's, announcements.
In that case it is mostly people saying a bit too much in social gatherings and conferences or just being too excited about their project.
The most difficult part is not finding leaks, those are everywhere. The most difficult part is connecting the dots.
One of the biggest sources for Nintendo leaks for a while was their European branches because they weren't as centralized, had to outsource most of their work and it was usually just 1 or 2 PR persons in charge of an entire market.
The most significant change in the leak process is the speculation. It used to be that a title like would leak and that was that.
Now people come up with wild theories what it could or should be. Plus Nintendo is starting to weed them out systematically with their own controlled leaks and rumors.
