It's entirely possible it came from a channel that wasn't eligible, or from a google employee, or own of their own security testers, etc.