UUIDs should be reliable. If it isn’t, it is a bug of the vendor at should be reported back to them.
Scanning the Project UUIDs is not enough - since multiple files from the same discipline or multiple discipline can validly refer to the same UUID.
Model header is not reliable, partly due to lack of standardisation by buildingSMART (issues with IFC-SPF headers have been reported in the past in these forums), but also because some formats simply don’t have headers. E.g. IFCJSON.
I think we should progress past this “my model is atomically contained in a file” paradigm in the future. The IFC dataset should be seen as a central code repository or database, by which authoring apps can extract and manipulate subsets of the data through partial data exchange, which may be file based, or non-file based.
Until we get there, and when most of us are still working with individual files that duplicate the same project 5 times - I’d just check for the same filename to know if it’s a revision of a previous upload.