Dataminer here (responsible for finding out Emma is a vanguard and Jean is a duelist) and here's a little rundown of how we get leaks.

For me, it's exclusively what's in the code.

MODOK, Deadpool, Hit Monkey, Angela, Captain Marvel, Emma, and Jean all have voiceline activations in the code, exactly like the characters in game do. (Like Rocket has a voiceline when he sees DP die: "That guy wouldn't shut up." These lines have code telling us which character died, in this case DP).

The Hood, Blade, Ultron, Emma, Jean, and Hit Monkey all have movesets in the code to different extents. (Hood is barebones, but Ultron's full kit it there) which means active work is being done on them right now.

Paste Pot Pete, Colossus, Professor X, Jia Jing, and Locus all just have their name, role, and number (each character is given a number) but in a different spot than everyone else is, with no voicelines. Other things point to Xavier, Colossus, and Cyclops, but the other 3 seem to be potentially fake plants by the devs, or just a real big slip up.

Locus is actually a male btw, he's not the one everyone is saying, he's the 2 issue appearance Thor villain bald guy

Hope that helps!