they probably narrowed it down to one person and approached them with the logs and "admit and be fired or don't admit and legal (and all the bad/expensive stuff that comes with that) will be engaged to get to the bottom of it starting with you".

You can also easily narrow it down to a time period. Find out when leak occurred and then look at prints shortly before that.

How likely is it that there would just happen to be a file with exactly the same wrong size in the printer logs?

I‘d say if the letter was short it‘s pretty likely.

Maybe there was few % error but no other candidate.

Which printers in that timeframe ever directly printed word files?

It would be the resulting spool file that gets measured, not the source Doc file.