you're right, this is a pretty bad failure mode. however, a similar (though much less severe) risk is incurred when we make universities responsible for handling threats. if someone poses as you on social media and makes death threats against another student, a court of law might find insufficient evidence to prove that you actually made those threats, but good luck showing the account wasn't yours under a preponderance of evidence ruleset.