Of course, all this merely raises the problem that leaked emails are hardly a RS until they get quoted by somebody and are alchemically transmuted into RSs.
There is no such thing as a "reliable source". The reliability of a source depends on what it is being used as a source of. The leaked email, whether direct or quoted, is not a reliable source for anything contained in it. The article that quotes the email, however, is a reliable (primary) source for the *claim* that the email was leaked. All we have to do is prefix the appropriate sentences of our article with "So-and-so claims that", and the sources qualify as reliable.