How did they hijack his identity? They just reverted to an older version instead of the the malicious update, and suspended his account.

For them it must look like a malicious hacker took over the devs account, and reverting the malicious actors changes is exactly what I'd expect of a responsible custodian.

If you want to trick people into downloading malicious software, don't do it on someone else's platform.