If an online security company distributed a game they made via their website and allowed users to verify the game they were downloading from their website was the official version by using an MD5 hash on it. When one day they discovered that their game had been replaced by an imposter game with the same hash.

How was this possible?

Also, what would be 3 recommendations to that same company to improve its method of software distribution?

And finally, what would the technical risk be for users who downloaded the imposter game?