The original language in the last paragraph is "...para solicitar la retención del contenido y los datos relacionados con la investigación antes mencionada."
The Github English translation of this is (caps are mine) "...in order to request both WITHHOLDING the content and data related to the aforementioned investigation."
However, I believe a more accurate translation is "...in order to request PRESERVATION of the content and data related to the aforementioned investigation."
If you look up the Spanish verb "retener", it can have, broadly, two applicable meanings in this case: "withhold" or "preserve".
I don't believe the language in the order should have been interpreted as "withhold", because they are ordering to perform an action on the content AND the "data related to the [...] investigation." This would be IP addresses, access timestamps, GitHub account information, etc., I would presume. It doesn't make much sense to "withhold" that sort of data. It makes more sense to "preserve" it.
To me, this appears to be a request to preserve data, not to remove data.
A case can therefore be made that the GitHub decision to remove content went above and beyond what was expressed in the received written order.