Could someone doctor an email to make it appear that it was sent from a different sender at an earlier date? For example, could someone who knows my email address make it appear that I had emailed someone last year?
Yes, there are a bunch of different ways to forge emails. Almost the entire contents of the email your receive is sent as data over SMTP, and as such, the headers are just as forgeable as the body: that is, trivially. This is why spammers can send mail that appears to be from your own account (or someone else's) on an arbitrary date.
However, there are a few things that can prevent this from happening. First, every server that receives a mail over SMTP inserts a
Received header in order. This header states information about the transmission: the server from which it was received, the server which received it, the email address to which it was to be delivered, and the date and time at which it was received are all customarily included. Thus, if the recipient's mail server received the mail from an unexpected source (i.e., not your mail server), that would likely be suspicious.
There is also DKIM, which cryptographically signs various header fields in the email. This is an assertion by the sending mail server that it has seen these fields and presumably believes them to be valid. Most providers include the From, To, and Date headers, as well as the Message-ID (which often contains a server-assigned timestamp), so if the message is signed with DKIM, these entries cannot be changed from the ones the server saw without detection. Whether unsigned emails should be presumed forged and whether the server is scrupulous about checking the headers for validity before signing are quality of implementation issues (that is, determined by the sending domain's policy).
For example, it is well known that Gmail signs every mail that goes through it (for domains they control) with DKIM and that it does not permit people to send from addresses not associated with their account. As a result, it would be nearly impossible for someone to forge an email since the signature would not validate, and an unsigned email could safely be assumed to be forged. Other domains will have different policies.
Existing answers are correct, but incomplete. I would like to highlight two other scenarios.
First, about SMTP.
Under some conditions, someone can connect directly to the final SMTP server and deliver an email. SPF for instance could be used to prevent that.
If that was to happen, then the sender has full control over the email, except the possible last bit added in the header by the final SMTP server.
That means that all headers but the last one (or ALL, if the final SMTP doesn't add a header) are under control of the sender, who can make it look like the email went thru a long list of legitimate email servers.
However as long as the receiving server includes the date in the added header, there will be a discrepancy.
Second, about emails in general.
You do not necessarily have to store email on a third party server. Emails can be downloaded on my computer and deleted from the server. Then, we're talking about files on my server, which, with the right knowledge of course, I can edit to make look like anything I want.
Also most server storing emails allow access using IMAP. And you will find nice tools that allow you to move emails from a provider to another, using IMAP. Give your credentials to both account, and they will copy all emails from source to target. It is similar to when you send an email using an email client like Thunderbird... The email is sent over SMTP, but the copy that goes to your account in the sent folder is actually placed there using IMAP.
So somebody could use IMAP to place an email with the exact content they want on their account.
At that level, forensic analysis might help prove the fake. If still available, server logs. If the email header says "received from server 10.0.0.1 on 01/01/2020 at 21:00" and the SMTP server logs show no connection from 10.0.0.1 on that date/time, then it could quite be a fake. If the email has an attachment that use Y-enc and is claimed to have been sent by Outlook, while Outlook doesn't support Y-enc, then it's likely to be a fake.
As long as there's no cryptographic signature, yes, there are various ways to make an email appear as sent from someone else. In the end, an email is stored somewhere as file or database entry.
Determining if the email is legit is a forensic job, and depending on how the fake would have been made, it may prove quite hard, and may require to involve a court (to get server logs, granted they still exist).
At the SMTP level, the SMTP server receives a fully composed text consisting of the headers, a blank line, and the body. It also has what is called the enveloppe addresses and what are given in other commands of the SMTP protocol.
A normal server adds some lines into the header normally a
Received one and optionally others. But it neither controls a consistence between the enveloppe addresses and the header addresses nor removes any existing header.
That means that if the message contains headers like
From: joe.biden@white_house.gov Date: Tue, 1 Apr 2021 12:00:00 +0000
chances are that a mail reader presents it as being sent by Joe Biden on first day of April.
The limitation is that if any header line can be forged, it is not possible to forge them all (unless you have full control over the last SMTP server) because each server on the chain should add its own received line. So if you have any doubt on the authenticity of a mail, you should first check the chain of servers. If the first one is not consistent with the From address, chances are that the address has been forged, and same for the date.