I’m still learning how keys work, but as I understand it in some cases it counts as if the user has “purchased” your game, which means the user will get all future updates. Not sure if revoking such a key would revoke access of that user, but it’s worth keeping in mind.
In this case the user didn't donate to the game on itch. They downloaded the prerelease version somewhere else, then downloaded the free itch version to gain access to comment, then uploaded the former to mediafire, then posted that link via itch comments in an act of Hate. I see no tools to limit the actions of commenters in any way (links, imagery, etc), so I've resorted to turning them OFF. Going to look into the forum features in the meantime..