According to Politico it was a former board member of the Restaurant Association who leaked it. LINK: The first woman was identified to POLITICO by a former association board member, and her identity was confirmed by two additional sources.
Which I bet if they were identified would have their own legal problems with the RA for going public with company private information. They probably signed an employment agreement not to leak such things. We still dont know from them what the allegations were, and maybe they dont know.
That is why I always wonder if Cain calling their bluff might have been better. It seems the worst thing he could do is get the RA to release the woman who got the settlement.