I am also not a crypto expert, but as I understand it: Micah could have also encrypted the email with the key given to him by the 'anonymous mailer', included the hash of that key as part of his message and then signed the whole message with his own key. Since Snowden trusted Micah's key, he could verify the email signature and then check that the included hash matched his own key. A MITM attacker could intercept Snowden's first email and change the key, but then Micah would have hashed the fake key and included that in his email, which the MITM couldn't alter without breaking the signature, then Snowden would have seen the wrong hash on the reply email and know of the presence of the attacker.
An anonymous person contacts you - how do you get their key from a public authority? There is no impersonation attack possible in this case.
Someone claiming to be Edward Snowden contacts you today (now that he is longer anonymous) - in this case yes, the author just including their key would not necessarily be secure.
Snowden solved it by requesting the public tweet of Lauras's key fingerprint which was enough. Having the match of the fingerprint is enough. It's much smaller than the whole key. For example, if Laura's key is 4096 bits to print it you'd need around 700 letters. But to verify some 4096 bits you have to actually be Laura's key, it's enough that the fingerprint of, for example, 160 bits match: the math magic involved in creating the fingerprint should guarantee you that nobody can create another key and have the same fingerprint.
In the article, the fingerprint used 4 bits per letter, and there were 40 letters, so it was just 160 bits that Snowden used to verify the key.