each instance has its own user base, charlie@instance and charlie@otherinstance are not guaranteed to be the same person any more than @charlie at twitville and @charlie at ig.
It's already happening. I saw a sh.itjust.works user impersonating a lemmy.world admin and presenting opposite positions to what that lemmy.world admin believed. I use keyoxide to help provide confirmation that yes, @Cube6392@beehaw.org and @Quill7513@slrpnk.net are the same person, both of them are me, don't panic.
I mean slightly bad example since Microsoft migrated a bunch of their hotmail users to outlook addresses hahahaha. But yeah. I especially feel that way about people who want all !news communities to just be aggregated together when that doesn't actually make sense when you think about it for more than a second. !news@beehaw.org and !news@ttrpg.net don't actually have much in common, in terms of what they're about. I know !news@ttrpg.net doesn't actually exist, but it feasibly could exist as a community for discussing table top role playing game news, like if Dungeons and Dragons has a big new release of material or something
I mean, it'd be similar in validity as charlie@outlook.com pretending to be charlie@gmail.com. Yeah, it'll fool some people, but easily checked if you keep your head about you.
The difference is that ActivityPub clients currently only display the username part and hide the host for some reason. This can lead to confusion, I don't get why the full address isn't displayed by default.
Email does that too. It's even worse, you can make "support@microsoft.com" show up but it's really badguy@somewhereelse.com. Granted, many emails hosts are getting better at flagging these, but one can still click the name to confirm on Kbin or Lemmy.