Have we forgotten you can authorize witho authenticating? I can prove I'm inside the Google office without saying who I am
To pull an example out of thin air, would you risk whistleblowing to TruthWave on Amazon if you knew that the Washington Post was running TruthWave?
This is why whistleblowers now often work with two different organisations with different ownership/politics, or in different branches of media, or with a journalist backed by the ICIJ (e.g. the Mossack Fonseca leak investigation was shared with the ICIJ).
But yes, any generic online whistleblowing broker with dozens of concurrent cases is going to be such an obvious target for state or organised crime interference. Anyone making a business of brokering whistleblowing for a cut of the reward is an obvious risk.