What should GA creators do if a winner claims the key is a duplicate, but they know it's good?

I'd ask the guy to take screenshots of him trying to activate it on his account, complete with today's date and time in the screenshot.
If necessary, tell him you need the screenshots to get him another key from [insert site here].
He can still get around it by using a dupe key he already owns , but maybe it will let him know you don't believe him and maybe pressure him a little more to activate the key.

I think it's even more horrible if you discovered an old bundle you bought ages ago but you remember that you didn't activate games you wanna give away.
Anyone can just fool you and you will think that everything is okay because you can accept that you forgot that you gifted it to someone...

You should check to know when the key was activated on account X by asking the Y game store if you have bought it directly from there.

give him another.
report to support.
too many tickets for the same issue, he will be warned or suspended.

or
if possible, ask the key provider to disable the key and give you another. i think humble bundle could do that with some games.

Any point in reporting the incident and hope that Support would keep track of other similar reports against the same user? This info could be used to show there's a pattern to this behavior (justifying a ban).

Yes, that. If it never happened before, we can't really do anything since they might be saying the truth, but you can try contacting the support from the website you got the key from.

It hasn't happen to me yet, though I have an experience to receive an used key. The creator said it was from Groupees, never used, but the key didn't work. So we agreed to delete the GA, I don't know whether the creator contacted Groupees' support.
After story... the creator suggested me to select one of their spare games as a token of apology, I accepted a game which was free once, cannot be made as a GA here.
I always write down(Ctrl-V) keys from sellers not to make a mistake, but two times Bundle sites gave me bad keys. Fortunately, the bad keys were for me, not for GAs. I'm afraid sometimes such an accident happen to me, too. -_-a
And if I'm in such a shoe and absolutely sure of not-used key, I'll check winner's record first such as any rule-breaking, trading feedback etc. Next step will follow the result.

Contact winner, buy a new key and send via chat, require immediate activation. If winner still claims it's duplicate, report to support (may also request a new winner). If it's cheap enough I might buy a gift copy on Steam and send to them directly and blacklist them after confirming receipt.

I only reveal the keys to be given away when I was about to create the GA, so I have 99.8% confidence the key would be working.

I've had it come up a couple times. Once I thought it was the winner but turns out I just done goofed, but if the key is cheap I give them another (and then blacklist if I suspect foul play). I've never had it be an issue; sometimes I "encourage" the winner to "try it again" and suddenly the problem goes away.

I don't see how anyone could ever know for sure that any key isn't a dupe. I think I have gotten at least 2 duplicates from good trustworthy sites.

I'd immediately give the "bad" key to a friend to try (or try it myself if I didn't have that game).

If it works, at least your friend got the game and not the cheater.