Mitsuki knows who it is.
He let the masked person escape, probably because he recognized her as his classmate.
Mitsuki is a great sensor after all.
When Mitsuki told Boruto that he knows who is behind the incidents, the scene swapped to the hospital room of Sumire, with an open window and an empty bed.
Meaning she is less injured than she makes out to be.
She can move around.
The masked person had bandages around the legs.
Is short (academy student size).
Slender build (likely female).
Sumire does not have family.
Orphans are often taken in by root.
The buildup they are given likely moves towards that she is the masked person.