She uses an independent music distribution service called Distrokid that she uploaded the song to and scheduled release months in advance. Because every music insider ever has access to Distrokid scheduled release servers (it’s super easy to hack), they were able to get the song directly from Distrokid and post it online. Also, the second time she leaked it herself by releasing it 2 weeks in advance.