That's not the issue here, regardless of if it's true or not.

The issue here is that if you have some upstream with license XXX on it, you can most certainly slap some YYY license on your repo, but that doesn't make it true.

This is like when someone pushes up a corporate private repo and puts an MIT license file on the repo.

Releasing code as GPL when you dont have the authority to do so, does not make the code GPL.

Certainly, as a consumer you can say that you 'didn't know' it was not actually MIT, but that doesn't absolve you from liability; as a consumer, you are required to do your due diligence, and if upon finding that you were mislead / mistaken / whatever, take steps to remediate it.

...otherwise you're liable.

It's that simple.