Those who caught it were indeed very clever. But the attacker did make mistakes, particularly the Valgrind issues and large performance regression. That ultimately is what raised suspicions.
Because anyone has the resources to test this locally and find the issues, but they just didn't have the time anymore.