Nah, hashes were public as proof (Usually later followed by a zip file matching the hash).

On IRC, we generally knew who did or did not have vulns and trusted not to BS. That implicit trust did make things difficult.