The aircraft's Flight Management System (FMS) can be loaded with software that periodically sends position reports and flight tracking data to ground stations via ACARS. If the particular software in use sends the full flight plan or at least the next few fixes periodically with estimated times, this would expose any changes in the flight plan to the dispatch office.
The incident flight in question had its ACARS turned off at some point and the "12 minute" figure is probably derived from the time between the last ACARS message being received and the radar observed turn off course initiated. They would not be able to know exactly when the buttons on the FMS were pressed, but they could narrow the time down to a range when information changed between two automated reports sent via ACARS.
Relevant chronology:
01:07 final ACARS transmission
01:19 final voice communication
Interval: 12 minutes.