in case this thread does not get removed, as a caution to all reading this:
you cannot trust scanners. least of all the ones itch is using. no positive scanning result proves nothing.
please use some sort of sandbox mode to execute games from untrusted sources. being hosted on itch is not a trusted source. not even when the game links to socials of the original developer. those other socials need to link back and also need to be genuine.
so to anwer your question about proof, it is by deduction.
there are two curse of dare projects. one uses a misspelled username. one uses a repacked file. one is paid. one is free.
so there are a few possibilities what this could be.
simple piracy. but why impersonate.
scamming for donation money. retrieving the money takes time and is risky.
distributing malware.
the original developer released the game twice with different accounts.
something else.
what would you pick?