If the game uses the Steam SDK, they “of course” can at least check that the request comes from an authorized game (SSO via Steam). But sure, people who bought the game can still easily troll the dev, unless they also employ some kind of anti-cheat system. But from what it sounds like even then a troll could simply play the game excessively and then ramp up costs for the dev.