So, let's pull out Occam's Razor:
- choice A: Google is logging all unencrypted communications from their staff (a rather vast amount of information altogether, I suspect, given how Google employees throw data around), in order to be able to go back retrospectively and wade through it to find leakers
- choice B: Google grepped through Gmail to find the leaker, which they have a complete legal right to do and has a marginal cost of zero.