If you can distinguish federated users from your own instance users, could you implement a manual verification process involving for example a bot that asks for a TOTP you can only get from the forum’s user profile section, in order to “authenticate” the user and link it with the forum user?