Though I suspect that means that either the clients are gonna start visibly stuffing instance names at the end of the username – maybe some abbreviated form of instance name – or there’s gonna have to be some other effort to stop users from pretending to be other users and creating problems.

You can distinguish between users by their user icon, but that’s user-selected, not assigned by the server, so a malicious user could just clone another’s.