Are we overstating the importance of this whistleblower? The written decision of the panel is pretty clear the only evidence presented relating to Oxford and Ipswich came from Saints. In brief:
Paragraph 2 says we were charged by the EFL with spying on Middlesbrough.
Paragraph 3 quotes the specific Regulations we breached.
Paragraph 4 says we admitted the charges and a hearing date was arranged.
Paragraph 5 says Boro asked to intervene and that request was denied.
Paragraph 6 says (this is a direct quote) "In the period between the First Notification of Charges and the hearing date the Respondent made reference to two other similar incidents of observing training sessions of other clubs in breach of the Regulations."
Paragraph 7 says we admitted those extra breaches but said we thought they were outside the scope of the original proceedings.
Paragraph 8 says the EFL then decided to bring extra charges and wanted to consolidate everything into the same hearing. We objected.
Paragraph 9 says the panel agreed to do what the EFL wanted. It also says "the EFL were not adducing any further evidence"
"The Respondent" referred to in paragraph 7 is Southampton Football Club. So it was us who told them about those incidents and the EFL didn't provide any further evidence in relation to those charges. Later in the decision we're criticised for the initial lie and there's a reference in paragraph 39 to the EFL having told us they were investigating "another incident" but, again, paragraph 9 says the EFL didn't put forward any evidence in relation to Oxford or Ipswich, presumably because they didn't have anything worth presenting to the panel.
That being the case I doubt there's any more evidence available on anyone's phone. We would have found it and, for a variety of reasons, I think we'd have passed it on. The Athletic have also reported more details of the messages on phones (Tonda not being happy about the quality of information gathered previously, the stuff about wearing Eastleigh kit, the doctored joke pictures of Salt) so the messages the panel saw clearly included a fair amount of detail and there can't have been anything else in there to suggest more spying.
I think it would be hard to prove there were more incidents. I doubt clubs keep CCTV evidence for that long, with GDPR you'd have to justify keeping it for an extended period and pay for storage and there's no obvious reason a football club would decide to keep security footage longer than any other business. CCTV also may not be good enough quality to identify an individual anyway and, depending on where their training grounds are, clubs just may not have that much CCTV coverage.
As you say, it's also plausible that there were things about these specific teams or matches that might have triggered spying. Ipswich was a key game and they were training at Eastleigh, which is probably unusual - they'd played away at West Brom on the Saturday and were at ours on the Tuesday so I guess they didn't go back to Ipswich in between. Boro and Oxford both train in or near places the general public have access to (the golf course for Boro while Oxford train somewhere with 5 or 6 a side pitches the public can rent out), Oxford had changed manager and Boro was another key game. A lot of other training grounds probably aren't as easy to access. I doubt you could just wander into Staplewood for example.