Unfortunately hiding behind plausible deniability is not necessarily an unrealistic plan on the part of the email sender.
As already discussed, DKIM signatures can verify the authenticity of an email and that it was indeed sent by the email provider from one address to another. The trouble is that this doesn't prove that a particular person sent the email - only that their account was used to send the email. If you can get the originating IP address out of the email provider (either in the headers or elsewhere) and trace that to a particular physical location (which can be hard after-the-fact if the home IP address has changed) then you could even establish that their account was used to send the email from their home, BUT...
Someone who thinks this through a bit more might still have plenty of options, especially keeping in mind that with criminal accusations the relevant level of proof is "Beyond a reasonable doubt". I.e. (said by the person who is being accused of sending the emails):
- I had lots of trouble with viruses and malware on my computer around then. I bet my email got hacked (and yes, as a security professional I roll my eyes at that, but it doesn't mean it won't work)
- My teenage (aka underage) son heard me complaining about [COMPANYNAME] and he admitted to me that he logged into my computer and sent some emails to them (probably plenty of people out there willing to throw their kids under the bus, especially since young kids might not see any repercussions at all).
- I left my computer open at starbucks while I went to the bathroom and when I came back 5 minutes later someone was on my computer. They ran away when I yelled at them but I didn't see anything missing so I just forgot about it until now... (obviously won't work if you've tied the email sending to their house)
Granted, depending on the circumstances such stories might get someone laughed out of the room, but they might not. I can't make any claims about that, because everything I know about court rooms I learned from TV crime shows. However I think it is important to keep in mind that all you can really prove is that a given person's email account was used to send an email. You can't even necessarily prove that it happened from a given location - only that a computer at the given location was used to send the email. After all if someone remote connected to a computer in someone's home and used that to send an email, the email provider would still see the person's home as the "originating" endpoint, even though it isn't really.
Probably the best way of "proving" that a particular person sent the email is by looking at the specifics of the language (i.e. schroeder's answer).