Seems like the publishers could relatively easily figure out whose credentials are being used by searching for presumably uncached files, which will then trigger an access to the file using the credentials Sci-Hub is using, no?

But I suppose it's no use since the authentication credentials to scientific portals aren't that exclusive anyway, so playing whack-a-mole would be pretty ineffective.