Craig was building PGP from source himself at the time. It would have included any new/experimental versions of the cipher suites.
It wasn't even _in_ the software until a year later; by "the software" I mean the actual commit that introduced that selection. Building from source wouldn't have done it, because it wasn't in the source.
Someone can customize their pref hashes; sure; but managing to predict the exact selection and order that the software would use later? While also, later that day, building another key that was bog standard for the time (1024 bit DSA, normal flags) and making that one public. Come on. The forged blog posts should have been enough.