There's a pretty solid case that the invasion stems from aquarium releases.
There's no doubt that scattered lionfish have been in the Atlantic for at least 30 years. We have reports of dive guides and hobbyists releasing them at least that far back. The difference was that they were never dense enough to establish breeding populations. We have Pacific tangs from aquarium releases in the Atlantic too, but they aren't established.
Sightings around FL became more and more frequent through the 1990s and in 2000 the first documented captures occurred there. Since then the pattern of sightings and captures has moved quickly north and more slowly to the south. That's exactly the pattern you would expect to see if south FL was the original introduction site. Furthermore, the fact that the animals hadn't yet reached their potential range limitations to the north suggests that the establishment was relatively new in 2000.
Genetic tests have also shown that the lions from the entire Atlantic seem to have come from just a handful of individuals from the same original Indonesian population. Although it's only circumstantial, pinpointing Indonesia as the original source adds some credence to the aquarium escapee theory since as we know, Indonesia is one of the biggest exporters of ornamental fish.
Given that we know there were a handful of these fish released at a single point in south FL (i.e., high density) a few years before their establishment was discovered, that release seems the most likely culprit. Otherwise, to fit the evidence there would have to be several releases of lionfish from the same Indonesian population at roughly the same time into a small enough area of south FL that about 6-8 of them would form a dense, breeding population.
Given the long distance they would have had to travel and the genetic diversity that is preserved, it's extremely unlikely that the introduction was via ballast water.