Secondly, it is often relatively trivial to identify people. You'll remember that the person who posted the Seigenthaler hoax was identified from his IP, and lost his job (I think he got it back afterwards, when Seigenthaler took pity on him and spoke to his employer). Furthermore, many established Commonists and Wikipedians either disclose their real names on mailing lists and/or their user pages, have pictures of themselves on Commons from Wikimania or other Wikimedia events, or are otherwise trivially identifiable. Take the recent Beta M case, for example.

Yes, an anonymous uploader who made only one edit from an Internet café may escape scrutiny. Although the other day I came across one uploader who had inadvertently uploaded geolocation data from his mobile phone along with his image, identifying the precise street address of the bedroom in Germany where the image was taken ... many mobile phones these days include geolocation in their metadata.