Using nip5 domains in the mix to identify a profile and its followers might work. But wouldn't this open an attack vector?

There is no way to recover sats from a lost wallet after all. Self-custody is a tough job and a great responsibility. If you lose it, you lose it.