Yeah exactly. My thought was he probably found the leaker in a much more mundane way, but being undeniably great at PR he decided to spice up the story with this little bit of detective work. It sounds so clever you want to believe it, even if it's pretty impractical(not impossible though!). You know what they say, don't let the truth get in the way of a good story.

It'd be even easier than that. Walk to the person's desk and ask them to bring up the document that they printed on ${printer} at ${time}. If he can't produce a document of the correct size, he's your guy.

almost as good as the odds that he got something pretty close, then changed the details a bit to fit the narrative.

or, he stayed up for two days until he got it exactly to match by tweaking his approach a little at a time, and actually matched it to the right person. Honestly, he seems like he'd do this.

You wouldn't do that though, would you? You'd type the thing up, print it, see that the printer received a 4.7 KB (or whatever) doc and look for a 4-6 KB doc the week of the leak, and then you have 100 documents to go through, rather than 100000.

It's also possible that he calculated the number of bytes, searched the logs, didn't find anything and then tweaked his numbers until something matched. And then fired that random person to make a statement and lied about how he found out who to fire.