First off, the use of the term signature here is improper. I know that they are using it in the Twitter documentation, but that's not the correct name. "Signature" normally refers to digital signatures which are part of asymmetric cryptography; i.e. RSA, DSA... Here, we have a MAC.
It is not "SHA-1" which is used, but "HMAC/SHA-1". HMAC is a MAC algorithm which is built around an underlying hash function (here SHA-1) as a building block, but there is more to HMAC than simply a hash function. HMAC is a MAC, which means that it uses a secret key which the Twitter documentation calls the "consumer secret" (yet again, that documentation uses the term "key" to designate something different, which is a great source of confusion). This secret key is involved in the computation; it is needed to produce the HMAC output but also to verify it. This secret key is known to both the client and the server, but to none other (it is "secret"). HMAC is so that each HMAC output is specific to a given input message, and it is not feasible to forge a valid HMAC output for a new message without knowing the secret key, even if many other pairs message+HMAC output are observed.
To sum up, the server can verify the "signature" from the client by using the "consumer secret" which is known to both client and server. When the server sees a valid HMAC output, it knows that the message comes from someone who knows the "consumer secret", which can only be the client, or the server itself. The server knows that it never produces messages with that exact format, so it must come from the client -- the specific client who knows that specific "consumer secret". The client is thus authenticated.