All downloads were authorized. The number is just so high, that you assume foul play. You do not even know, if the same account downloaded the file, unless you only have one customer. But that is besides the point, because:
The download numbers on Itch do not tell the number of completed downloads. They tell the number of started downloads. There is a topic about this every other week.
And why would someone share their account to download the thing from the platform several times? They would be cought immediatly. It would be far easier to download it once and then share the file elsewhere.