This allows homeservers to specify trusted providers to prove identity with, which clients can then offer to their users to log in with. See this in action already with Element, the flagship Matrix client: https://app.element.io/#/login
You'll see that several social networks as well as Github/GitLab are offered to login with.
You could not simply replay a message as events, which contain messages, are:
* Signed by the sending server
* Reference one or more parent events in the DAG
* Have an event ID which corresponds to the hash of the entire event
So simply replaying a transaction from one server to another will result in the receiving server either dropping the request (but still returning a 200 for idempotency) or soft-faoling the event, in which the server will accept the event, but realixe it's fishy and not relay to clients.