When a player runs the execute command and makes a player do /say (/execute as {player} run say hi) The Player reporting system lets you Report that message (hi), This could be used to fake messages.
This also works with command blocks
Attachments
Comments 4
If that's the case I guess the bug here would be that the message can be selected in the UI despite not being signed.
From what I understand, this is also the case with any other unsigned messages: the (lack of a) signature is only looked at on Mojang's side.
Using a third party modification to disable signatures, it does indeed appear that real non-signed messages, sent by actual players are selectable in the vanilla client's report menu.
[media]
[media]
The message sent with this is not signed by the player, meaning Mojang Studios' moderators have the ability to identify that those messages were not truly sent by the player who appears to be sending them.