I did not yet encounter any scam with the collection mechanic yet. Maybe it is related to the scam blog posts, or they are targeted at developers. But if you say those are non-public collections, then no one can see them. Public collections do appear in the feed and so do blog posts. Blog posts also are findable via google.
I remember one thing Itch mangaged to successfully remove. It was fake download buttons. After they introduced that external link highlight, the criminals gave up on that method.
Sadly, they gave not up on being criminals. They try lots of things. I am seriously surprised, they did not do massive spamming earlier. Or maybe they did, but were so clumsy, that they got blocked at an earlier stage.
It is just so low and despicable what they are doing. They need to get jailed, but they probably operate in some corrupt excuse for a country.