Someone else did bring up the point that the canonical URL is stored, so that does make correlation a bit easier.
Doesn’t solve the concerns you’ve brought forth. For example, the “I don’t have an account here”. A local instance can correlate a local post to a remote post, being able to provide a “open on original instance” link but it can’t be done the opposite direction, which would relieve this problem.
As for hashing, it too certain what that would gain but at some point there was obviously a decision not to correlate by the message UUID (which would accomplish the same thing). Since I wasn’t in the room can’t say why.