I think giving a prompt to the user who is looking to exploit this loophole about just setting the project to "private" instead would help (user attempts to upload a different file type, large discrepancy in file size, radically different name. Have the system check for these things). Some people may be doing this out of ignorance and that would at least cut down on the numbers in theory. Another thing that would help in this situation is a "punishment" system to discourage this kind of behavior. From what I understand, users who do this don't face any repercussions at all. Updating TOS and putting these two things in place should be enough to dissuade most the folks from doing it.