Hmmm not sure if this is an actual problem or bad configuration.
Might be based on Org settings, my org locks this down since it uses ldap as source of truth for display names.
There's no way to "hack" it and spoof someone else. If you want to change your display name, you change it officially at the company source (which is straightforward and quick, so "Joseph" can easily be "Joe" or whatever).