"Git", (really, whatever git server you are using for your publicly accessible repo) only allows you to do that if you allow it to allow you to do that. Rejecting non-fast-forward commits is standard practice in every git shop that I've worked in.
$ git init --bare --shared foo.git
Initialized empty shared Git repository in foo.git/
$ cat foo.git/config
# ...
[receive]
denyNonFastforwards = true[receive] onlyFastForwards = true
However, we are a small team consisting of mostly Linux kernel developers, so that may influence the level of trust we put in not screwing things up. We also work pretty much independently; were that not the case, this would get ugly.
What team is that, and what are you working on?