NDA was the wrong term to use there but I’m sure there was a “don’t give the game to anyone” in there they might be enforceable. I hope they don’t sue, though
I don’t think Valve is going to do anything about a 20 year old beta being leaked.
Honestly, knowing how easy it is for just about anyone to contact GabeN (his email is publically accessible) and that this was a previous tester, I would say there’s decent odds they’re already contacted someone to make sure or already had permission to do so in some roundabout way. I have no way of knowing for sure, obviously, but it is super weird for this to pop up without the finder messaging anyone in Valve about it.