It's because they are reporting that somebody thinks they've found the dodgy code, rather than a statement of fact that the dodgy code has been found.