You’re correct. You can only impersonate admins (including system and discobot) if your email is listed as a developer email in yml.
There is a third option although I don’t recommend this personally. You can post as system via the API by using an admin generated API key that is valid for all users