Who's to say they don't already have multiple accounts? Surely being able to see at least a portion of their activity on a known account is better than all activity of their activity being anonymous.
No. Because accounts gain reputation. It's more likely they're able to pull off a supply chain attack from a known account then a new account. So, ban accounts as you find them. Obvious.
What’s “reputation” mean on GitHub? If it’s “valid looking commits to valid-looking repos”, it’s very trivial to fake that. You can fake the timestamps, too.
Account reputation means having contributed to projects with reputation.