it also dates back to the funding times of the AfD at which point the AfD had not yet been clearly right radical, but a side publishing it might very well be scanned by bots and then someone decent who was shortly a member during the early days and left due realizing this is going in a very bad direction might "permanently" be described as AfD member or similar in search, agent questions, e.g. done when they look for a new job
but I think the more relevant point here is probably the reduction of legal consequences and I wouldn't be surprised if whoever provided the site and the hacker are two different entities
lastly this seem to have been an exceedingly trivial but AI supported hack, so there is some chance the was done by a young and very inexperienced person who got more then they bargained for and try to somehow balance personal risk with the hope that this helps with convincing more people how bad the AfD is or similar
either-way multiple new sites and other sources have downloaded the sources and verified random samples where possible and it seem the dump is actually fully authentic
So the leakers may have already been under some pressure to not end up in jail for doing the right thing.
But intend can matter if you are caught can influence where in the possible range of penalties the judge will judge you.
There is also a chance the site provider and actual hacker/torrent provider are not the same person, in which case if they go after the site provider they could argue they just did automatized journalistic work with reasonable journalistic standards (not sure if that will work, but it would be worth a try; also only relevant if they are two different people).
Lastly the hacker might be very inexperienced/didn't really expect much success which also could explain the current outcome.
There is also the point that a website might be indexed by bots/search engines, the torrent might not and this could cause some problems. E.g. very very early one the AfD was not yet clear right radical and the mails date back to this time. If someone hat interactions with them only then but now get indexed by some search/ai which lets say an employer uses to screen hires this could have very bad consequences for that person without them having done anything wrong (if their connection to it really was only during the very very early days).
Why do you think the state is the leaker?