That is certainly one way of handling it, which is part of the reason this is so frustrating: Many, many sites have implemented working solutions to this problem to the point that it's an industry standard.
Itch.io doesn't even require a captcha to make a new account.
Nothing being asked for here is revolutionary, nor would it necessarily require huge amounts of effort on part of the itch.io development team. Expensive anti-bot software certainly exists, but it's almost assuredly unnecessary for this site.
I'm quite sure this could be fixed with a minimal amount of work, but at this point I'd just be happy getting these malicious ratings taken down and some sort of answer from itch.io at all.