A malicious person could create a profile with the same profile picture and name as Alice, but a different web id. If they now send a message it will look like Alice send a message. Verification still succeeds, as it thinks they are completely different users.