I mean, this is more or less why the vast majority of social networks eventually require email addresses (and may outright ban gmails) or phone numbers.
Different sites have different user protections. And this is highlighting that the federated lemmy instances need to figure out what that will be.