Have we confirmed how this was done yet?

Direct message with an image hosted somewhere the sender can check logs seems most likely?

Or someone operating a relay you're connected to - but that's a given.

Pretty sure the solution involves onions.