If it was compromised account trying to sneak code into the kernel, the attacker wouldn’t rewrite history since that would be obviously flagged when Linus tries to merge the pull request; as demonstrated by Linus in fact noticing the rewritten history. There was virtually no chance that this was an attack.