It's on the front page of the DB: "Several new Pokémon and forms have been discovered by 3DS hacker 'Smealum'."
3DS games were just notoriously difficult to hack, and were labelled as impossible to hack. But really, given enough time and boredom, plus intelligence helps too, anyone can hack anything.