To be fair, the bug reporting system is already operating on the honor system. Nothing prevents a user from reporting a bug from an older version. Nothing prevents a user from completely fabricating a bug report, including images and error messages.
So if someone wanted to waste Steve's time, they could.
If anything, it points to a lack of version or file integrity checking in the bug reports which would weed out all but the more malicious, competent users. For instance, generate a hash of the files he cares about on startup/on error detection, run it through a Feistel cipher with a random seed, and encrypt the scrambled hash with a public key that Steve provides. This signed hash is posted alongside the bug report. Steve then decrypts it with his private key, runs it through a Feistel cipher and then checks the hash. If it matches, it's the correct version. This can be automated; false positives would be rare.
To break that, you would need to know the exact hashing algorithm, the exact number of iterations in the Feistel cipher, and to be able dig out the public key.
A competent user could probably do this by trying to reverse engineer the code, match code patterns, and timing attacks on the cipher.
Your average run-of-the-mill mod user wouldn't know how to do it.
Your average modder, who would need to know some reverse engineering skill ATM, wouldn't have a reason for wasting their time on it.
So the threat would be a malicious user/modder with the know-how and determination, of which I imagine there aren't that many.