You know, there's one solution that hasn't been brought up in relation to impersonation that'd work the best because we're already doing it.

Moderate servers so that people intentionally impersonating other users are not allowed, and then block other servers that actively refuse to do this.

I guess that's kind of what we do with email, with varying levels of diligence/success