A thought - any professionally run software development and support team must use a source control system to make any changes and deploy new versions.
Testing is done prior to deploying new changes as part of the process.
So intentional code changes history should be available.
However I would imagine it would be really brazen, stupid, and untenable by the technical employees to knowingly take part in such questionable activities as to code the spoofing or other algorithms. Not that you can’t find or corrupt a techie, but less likely and not smart to in effect corrupt a whole IT team.
This logic gets back to setting parameters and/or manually initiated trading patterns being more likely if one were to engage in such alleged activities. This gets back to people deciding when to use and how much effect is targeted (decision making and implementation of such decisions, hypothetically speaking) and “pushing the buttons to drive towards the targets.”
So it gets back to what got executed and what/who drove it.
This has all been just an idle thought exercise and nothing more, and irrelevant and uninformed versus real forensic teams investigating real alleged activities.