100% their data was stolen. You can't enter any private data into AI and expect it to remain private.
Really looks like they aren't yet training on conversation histories effectively.
They might have determined that your canaries (whether it is a unique string, URL or similar) have a low signal-to-noise ratio and not worth following up.
Unless you provide more details, it's difficult to ascertain whether your conclusion is correct.