E3 is not where debugging stations come from. Bankrupt devs who fail to return hardware is. 90% of all dev PS1/PS2s you see on this site, probably came from the Acclaim bankruptcy.
I was told a story about a certain development company doing a 'road show' of their latest piece of software. I'm naming no names, but suffice to say they asked a bunch of gamers who also wrote a pretty successful fanzine to assist them. At the end of the tour the gamers packed up, were ready to go home and the company were saying their thanks. Off they trotted to let other minions do the packing up... Well, the security staff employed had NO idea about what was what and informed the gamers they could take whatever they wanted as it was all being heaved in the skip. One of the lads ended up with a brand new 360 Debug kit. Only used during the demonstrations. That's a true story, but I cannot reveal names for various reasons. I'd say that is a rare example of how these things hit the market place. However the other common route other than bankrupt dev houses happens to be review staff. There are also a few colleges who have dev hardware for courses and as either the courses come to an end, change to more advanced technology or sadly colleges go to the wall (as a couple have done), then that's another route to the outside. Never forget that the actual manufacturers are as guilty as anyone else. They employ 3rd parties to destroy various pieces of hardware and must be mightily frustrated to discover that some of these 'salvage' and 'recycle' companies simply sell the units on.
Dumpster diving too. I've heard some interesting stories about diving the Atari dumpsters back when the Jaguar got canned. Lot of random dev hardware and a TON of paperwork.