I did that. "Impersonation" is usually posting something with someone else's name, though. This is way past that, though - Substack that allows people to reuse hostnames + URL slugs, and put back-dated posts on them, so the entire original URL is impersonated.

I also just emailed Substack's security alias.