I'm not sure there's a completely thorough way of proving cheating on a single measure of a relatively short test. If I wanted something more thorough I'd probably compare the mean score on the non-cheat questions vs the score on the cheat questions though. Let's say you provide the correct answers on the "leaked" test. If the score on the leaked questions is significantly higher than the score on the unseen questions then you can confidently say there was some cheating. At that point you'd probably interview the candidates on their tests rather than throw accusations.