Exam questions were inadvertently leaked online weeks before the tests, prompting a review of the Victorian Curriculum and Assessment Authority's practices.