I would assume that attacks similar to these could be checked against device ownership - for example if a user has been the first registered owner of an apple device, their reports may be deemed more trustworthy. If they see a device being reused to submit similar reports, that could be a signal that reports are fake.