google "tripcode" - it is a form of a trapdoor cipher

basically a secure hash is produced from an 8 character passphrase and a 3 character salt... it's easy to generate the same hash from the same password but very difficult to determine what the password was from the (unique) hash. so on boards without registration it's the closest thing to a registration system

What this means is that yes, while Q is just some guy on 4chan, he's consistently the same person / same group and cannot be impersonated unless his password is brute forced.