It didn't have to be someone at Project Zero. Anyone with a bunch of network logs could have searched for some of the fingerprints or URLs that were publicly available and deduced the target from associated traffic.