> how can anyone without seeing the hacker doing his thing really know for sure what state it came from?

IDK, maybe using the same type of reasoning which helps convict criminals in cases where there are no witnesses.