You see a number for started downloads. It is not telling you the completed downloads. There are all sorts of connection problems that users suffer worldwide. Itch knows that. Therefore they provide that alternative download link for paying customers. It is called Download not starting?
Even if the downloads were completed, maybe someone used this file as testing for their download speed or a download manager.
The explanation that someone shared their account to pirate your file is the least plausible of all the explanations, in my opinion. And why do people download your game 5 times to begin with? I download a file only one time. Unless there is an update. Or there are multiple files and we are looking at the project counter and not the file counter.
I have doubts, that Itch will investigate. They have systems in place to catch hacked accounts. An account that is accessed by multiple IP in the same day would have been cought in that system and been investiaged because of that alone.
Maybe the buyer was travelling and tried to access the game over a shaky vpn with bad connection. Since it stopped after 89, the buyer gave up or finally managed to download the file uncorrputed or in full. Would be my best guess.