@pfefferle it was actually because of @ in actor IDs - the codepath for choosing a webfinger lookup over just accepting the URL as the ID only checked for its presence, and the code for webfinger lookups was only meant to run for the acct: protocol.
So yeah, not WP fault at all, just a combination of a bug and missing feature 🙂 Now both should be fixed.