There was no way for an eShop version to be obtained legit, everyone playing an eShop version was playing the dumped cart leak.As far as we known, some retail cartridges were out 10 days before official release and that was one of them that was dumped.
But is not be possible some 3ds with the game preinstalled leaked too and be legit too?