It doesn't matter if the developer didn't do it, all that matters is that IPO offers a backdoor of letting the developer get an infinite premine since all BTC sent for the IPO go back to himself anyway. Even if he didn't do it, he can't prove that he didn't do it, and there's no reason for anyone to take his word for it. This is why ALL IPOs are inherently doomed to fail. Even if you did an escrow, how do we know the dev and escrower aren't colluding? Everything about the IPO is a scam ridden concept.
With a proper IPO, investor identity would be disclosed at least to a third party for legal reasons (in many countries at least) such as the professional escrow handling it.
I don't know (or care) how BitShares is doing it, but many of the IPOs on these forums do not appear to be doing it in such a way that there is trusted independent validation of the IPO and that does possibly pose some legal problems.
It is possible to do it right.