It's a very basic issue and it should be there. All the legislation needs to do is to provide that person with protections that will apply even if the person doesn't identify themself. The presumption there, which can be made explicit, is that if they are later identified, then the protections will apply to them and they can avail themselves of the protection.
It's absolutely vital not to encourage anonymous reporting, because it will encourage confidential reporting and, typically, people will then approach a disclosure channel anonymously in the third instance. But when it's explained to them what the process is, they will reveal their identity to the appropriate people.