Just supposition. I suppose when the change involves a series of nucleotides, the longer the series the less likely that it happened randomly.
A scientist involved in gene splicing has seen small random mutations “under the microscope” (the sequencing data), and has also seen larger engineered insertions or swap-outs in samples he or his colleagues have tinkered with. I expect with experience he can tell the difference, based largely on length and likelyhood.
Normal mutations (for viruses) involve transcription errors and flipping bases. You get them basically one at a time. If you see a gene sequence that is entirely different, that is a strong indicator of intervention. Especially if it comes intact form something else. Like if you find a big chunk of HIV somehow got incorporated into a bat virus. That’s very suspect, in my book.