Here's a more likely scenario - the Russians had the server penetrated but wisely kept their mouths shut about it and did not release anything. They kept it for intelligence value. A Sanders supporter on the inside stole the emails and published them. When forensics looked at the servers the only thing they found was the Russian presence. Hence, the blame went to the Russians.
It would be too embarrassing to admit it was an inside job.
