When you create a download key in the Itch dashboard, at the bottom you have an option that allows you to indicate whether the key can be claimed by an Itch account or not.
Download key can be claimed — Enables anyone with an itch.io account to take ownership of the download key, preventing anyone else from using it.
It is implicitly understood that if the option is NOT checked, the key could NOT be claimed and could be used by anyone who has the URL and I assume that was the author's intention (I have no additional information other than what is written here).
I don't know if this is something allowed by Itch (the download key generation rules don't explain it anywhere). But if it were prohibited, it would be expected that this option would not exist and it would be mandatory to redeem the key.
I don't know if this is a bug of the original author or if it is indeed a bug of Itch, but since it seems to be something that is affecting several people, it is best to point them in the direction where they could get help.
Edit:
Personally, I think the best option would have been to create one key per game, have a set of stickers printed (many printing companies do this) and thus have only one download key per game. But this is just a personal opinion.