For obvious reasons, changing the files after approval and using hacked accounts that are old is precisly what malware uploaders try to do. Most of those accounts I saw with the malware last year were years old.
The evil guys adapt to what works. If Itch protects old accounts, they use old accounts. If Itch protects already approved files, they use those and change them later. And so on.
(And yes of course, I do not know what this is really about. It is just an educated guess. But after encountering near a thousand malware projects, pirated games and other dubious things like crypto, I think my guess is well founded, even if it were incorrect.)