Why not consider the alternative that the process is just inherently flawed? (As in, it has flaws, even if its intent is good)

If I look at some leaked source code, then contribute to your project, you can't know the code is stolen unless you also look at it, which you can't do.

You can reasonably guess if a large chunk looks "unusual" but it can't ever be perfect.