Both of them were. Baltar fingered Doral as a Cylon while Galactica was docked at Ragnar, and he was left behind on the station when the Fleet left. Since Doral had been a reasonably public figure who got a reasonably public marooning, everyone heard rumors about it, which is how it could've gotten back to Cavil (Crashdown was talking to Boomer about it in "33," remember). However, no one but Adama saw what happened with Leoben after they were trapped behind that hatch on the station (and no one but Adama and the deck crew saw Leoben at all), so that was much easier to keep secret. No one (including Cavil, obviously) would've had any idea that anyone would've recognized Leoben until they made the announcement of the humanoid cylons after the second Doral blew himself up and started showing off pictures of his beaten corpse publicly. That's a continuity error, by the way. The entire plot of "Litmus" hinges on the fact that someone (read: Boomer) left a hatch open that let Doral slip into a restricted area of the ship, kill a security man, break into a small arms locker, and steal the explosives he used to make his vest, right before he blew himself up. There's no episode if Doral didn't have to steal the explosives right before his attack. In "The Plan," Cavil gives Doral the explosive vest weeks before he blows himself up. I haven't decided to just assume the scenes were reordered for dramatic reasons in "The Plan" and Cavil stole the explosives (with Boomer's help) and gave the vest to Doral during the teaser for "Litmus" (something we have to assume about the Miniseries, as well, since it has Roslin leaving Caprica well before Baltar and Six meet in the park, though we know from "Epiphanies" that she was in the park at the same time they were), or to go for a more complicated fanwank where Doral, Boomer, or Cavil stages a theft and murder right before the bombing to make it look like Doral was operating solo and thus cover Cavil's tracks.