Seems the official answer is Leland. From the IMDb FAQ:
This was never explicitly revealed onscreen. However, producer Mark Frost later revealed in an interview that Dr. Jacoby's attacker was 'the same person who killed Laura Palmer.'
Therefore, it had to be Leland, while possessed by Bob. This is strongly indicated by Jacoby's reference to smelling burnt engine oil, a smell associated with the killer.
When Leland senses that Maddy is sneaking out, the implication is that he follows her and that's how he finds Jacoby. But as to why he attacks Jacoby, this is never clarified. Apparently, the creators simply tried to cram as many cliffhangers as possible in the season 1 finale. From the same FAQ:
During the filming of the first season finale, Frost and Lynch, fearful that the show would not be renewed, decided to place every character in peril, so that no matter what characters a fan happened to like, they would have a vested interest in seeing the series renewed.