Well it could have been a hacker, obviously he was interested in the GW scam.. so decided to try and penetrate the security in this particular research center. The first place to look is the mail servers and once there he would probably dump everything he could find and then run searches on it and package relevant stuff together.
Best argument for inside job is that nobody made a claim to be the hacker who pulled it off. Fame from that would just be too tempting. Insider on the other hand would probably be someone who lives off those research grants so he need to do everything to keep his identity secret.
I’m betting that it is an insider, that they know who it is and that they dare not touch him because he’s got a lot more he could release.