1) It is extremely unlikely that this was actually pushed to the github/dmca repo. Github has a bug where you can make commits to forked/"networked" repo's appear as if they're in the original repo.
2) They most certainly did not "impersonat[e] Nat Friedman using a bug in GitHub's application"; they impersonated him using a design feature in Git.
They wrote a commit message with Nat Friedman's email address using a design feature of git, but it was still a design feature of GitHub that took this non-gpg signed commit and linked it with Nat Frieman's account, making it appear very legitimate in the GitHub UI, without an option for him to change that.
2) They most certainly did not "impersonat[e] Nat Friedman using a bug in GitHub's application"; they impersonated him using a design feature in Git.