Users with administer projects access are able to edit the actual file path of a file associated with a release on the edit page for a release (eg. at http://drupal.org/node/231441/edit)
However, if the path is changed, the MD5 hash and file date associated with the file are not updated.
Comments
Comment #1
drummI don't expect this to be an issue on newer versions of project, please reopen if I'm mistaken.