As for hijacking usernames: If you are able to wipe and reinstall the instance you likely have the ability to just set my password hash to something else and control my account. As a user you need to trust your home instance.

So this partly happened on midwest.social, when the admin reverted to a three-day old backup. Other servers that had already cached comments from that time could still see them; those of us on the home server could not. I checked with my alt account.

I experienced it. I couldn't subscribe to the same communities with same username.

The only issue I’m really running into is that it says subscribe pending on some communities when I try to subscribe but I’m assuming that’s due to being overloaded etc…

Try refreshing the page after smashing the subscribe button