

That would require the VPN service to keep track of users’ usage and be able to match traffic to user, which most (or most of the big ones at least) very specifically, very on purpose, explicitly say they don’t do, which would be really bad for them if it turned out to be false.
Saying full source code leaked is a little wrong.
Plugin was always open source, and all plugins for that framework are required to be open source by the framework’s licensing.
Doesn’t change the fact that once one person did it, the code was available for anyone, though, you’re right.