That's a good point about the user authentication, but I'm not quite sure we'd need it quite yet to reduce spam in this way. It is absolutely something to keep in mind though.

I think the other instances allowing federation in the first place grants "I trust the owner to not impersonate users" part of the chain. In Reddit there's that trust too, the whole "I trust the admins to NOT edit my comments silently at the database level"...