Would the changes leave a trail?
“Would the changes leave a trail?”
Not really, since they only have the files that sent you.
However, if you had access to the computer that the web site was developed on and it was on a Windows 7 system, you could obtain various backup copies of the folders these files were kept in via Properties -> Previous Versions of the folders, and then restoring the backup folders VIA COPYING THEM (NOT RESTORING THEM), and then examining the modification dates of the files and what they contain relative to the faked files you received via differencing.
Short of this,it seems to me your best evidence is from the wayback machine.
Depends on the environment, but in general, if I modified something and didn’t want you to know - you wouldn’t.