Ask yourself this - how could someone in Syria contribute to code they've never seen before?
The same way that Western goods make their way to any country under export control, through intermediaries.
Coke can't sell to North Korea. Coke however can be sold (or made) in China and then gets shipped across the line to North Korea.
Is it really hard to imagine that Syria or Iran might be able to download from an intermediary country that might have a mirror of the distribution? Or had someone travel to such a country to download it? Or just went through a VPN or proxy? Or...