Our site is mango-works, the scammer's site was mangooworks.
If it was malware, that's even worse.... Itch didn't give us much information on what to do to prevent these things.
You go by mangoworks and not mango-works. Adding a minus sign or doubling letters is business as usual from the scammers.
You can't prevent it. Not without significant changes. And you as in you the creators least of all. It is something itch would have to do.
It is the users that can shorten the lifetime of a scam by reporting them and maybe harden their systems against attacks. If fewer accounts get hacked, it might someday be below the threshold, where it makes money for the scammers.
As a precaution, the sandbox method helps a little bit. The itch app provides one. And even before that, not downloading all the shiny new games from untrusted devs.