Not all of us can grep as well as we'd like. Besides, swiping only the most telling and highligy classified documents would've aroused suspicion. He might have

Not all of us can grep as well as we'd like. Besides, swiping only the most telling and highligy classified documents would've aroused suspicion. He might have been including some line noise to distract a system looking for patterns. Also, including unrelated but genuine documents would make his leak easier to verify because it proves he has access to the source.