It’s probably not so much an oversight as a natural consequence of the open nature of Lemmy. Same reason DMs on here are not technically private. Even if you implemented an anonymous report feature, instance admins could probably identify the user easily.