Client-federation users (e.g., youruser@nova logged into orbit) send DMs on the remote server. The S2S relay forwards these back to the author's home instance, but verifyAttribution rejected them because the author's homeInstance didn't match the sourceInstance. Now also accepts when the author's home matches the receiving instance (getOurOrigin()), covering the homeward relay case.