On update, can you send email to the purported author, telling them they've updated the package? (Similar to those "you have logged into some site from a new computer" emails.)
An easy way to undo a publish would also be useful.
An easy way to undo a publish would also be useful.
This could also save publishers from their own "whoops" moments, akin to gmail's super-handy "undo send" feature[1].