There is a feature called custom_tripcode hidden in plain sight in 8kun’s software that allows for the admins to bypass the normal methods of tripcode generation and make any password of their choosing produce any tripcode of their choosing. This means that 8kun admins, or someone working closely with them, could be using Q’s tripcode without knowing Q’s password.
To test this possibility, we built our own copy of 8kun using the open-source software that powers the site to demonstrate how this feature could be exploited by 8kun administrators in order to pose as Q.
Unfortunately, yes.
https://qoriginsproject.org/how-a-baffling-mistake-revealed-qs-identity/