That's really unfortunate, I have emailed itch io but I don't know if they will reply or not. I really hope they do take action!
Can you give some suggestions on what I should do for now?
Viewing post in Bots are mass rating my game. Rating bombing?
Looks like someone trying reach top of charts by dirty methods. I think admins have logs of actions (idk how structurised it on itch.io databases, but it must contain information about actions), where they can check IPs of users. It's one of the working methods to protect the platform. By the way, cloudflare protection must triggering on first page that user open to protect projects, but it protect only by manual search, not direct links