It is always a possibility to share an account, however, if they want to "hack" you as the games on Itch do not have DRM, the most normal thing is for a person to download the game only once and then upload it to a hosting like mega , filesharing, etc. Since it is much easier to download files from those sites than to share the itch account.
The most common thing is that a person tried to download the file several times, Itch counts as a download each time they try to start the download and not how many times the entire game was actually downloaded.
If, for example, I have 3 errors during the download, I will have tried to download the game 4 times, Itch will count 4 downloads, but the game was actually downloaded completely only once.
Normally, when you have hundreds or thousands of downloads, that number of errors is tiny, but if you only have 4 copies sold and you just happened to have someone who had a problem on their internet, it is a normal scenario that you can have 10 downloads.
The strange thing would be to have 4,000 copies sold and 10,000 downloads.
