My theory is that Mark Karpeles himself leaked this documents and is pretending his website and reddit got hacked, to strengthen his argument that the coins got hacked.

There isn't really any way to prove if he did or not.