I've been a player since 2004. As far as I know the source code was leaked by a Gravity employee. Ever since then, all other updates and additions have been coded by freelancers based on what they feel is correct by playing official servers and using the original code as base for the new updates.
Why Gravity didn't do anything to prevent the leak? -- You know the ol' saying...Once it's on the internet it's there forever. There were too many users that had a copy and even if they tried they could not possibly delete the files from those people's computers.
Why Gravity doesn't do anything to stop private servers? -- They can't do much. Sure, they can spend money and time suing the largest private servers...but what will they gain? Not much monetary compensation because private RO servers don't make enough money to make it worth it for Gravity. They might get 5-10k USD, maybe 20K max..but the legal fees to get this amount would probably by higher than the compensation. Multiply those legal fees by 10 or whatever amount of big servers you think they are and you can see how it can become a big dilemma. Sure, if the defendant is found guilty they usually have to pay the legal fees, but then as I said before, most RO private server owners do not have enough to pay for that.
Even if Gravity did attempt to sue the largest private servers, it would not solve the root of the issue. The players of those big private servers will simply move on to other existing (smaller) private servers and not the official ones. Also, these private servers are not all from the same country and I think we all know that laws and regulations differ greatly among different countries. Gravity might not even have the legal right to sue some of those private servers hosted in 3rd world countries.
All in all the best choice Gravity could have made was to concentrate their efforts into other games and hope that they learned their lesson about keeping their code secure.