not sure i grasp how nip-5 verifies an account. it just links pubkey to a domain. an impersonator could create a new pubkey and link to a different domain and only if followers know your domain can they differentiate