@uoxc @GossiTheDog Doesn't need to be that sophisticated..

Either (a) developer continues submitting other work whilst compromising at least one project. or (b) the account is in use by two people - the real developer and a hacker.

So the question becomes compromised account or compromised developer.

In the first case it's not that unbelievable that someone who was up to no good would try to cover their tracks by doing other unrelated things.