aha - got another idea. I'll just use a different format to display the admin comments. So the imposter can't mimic the format, though they can use the same username.
This is coded into the server-side site code, and normal users are not able to inject content into that other element to masquerade as admin.