Looks like someone trying reach top of charts by dirty methods. I think admins have logs of actions (idk how structurised it on itch.io databases, but it must contain information about actions), where they can check IPs of users. It's one of the working methods to protect the platform. By the way, cloudflare protection must triggering on first page that user open to protect projects, but it protect only by manual search, not direct links