Email: How do you prove that the server set the message id and not the client?

Github: How do you prove that the first commit was done with the web UI? And how do you prove that there wasn't a force push replacing that commit?