It's not that hard.

    - Look at the application logs
    - Look at the emails and reach out to a sub-sample of them to determine if they are real users
    - Look at the network traffic/volume numbers
    - Look at the architecture to see if it could actually support that volume
    - Look at the pattern of content in a random sampling to see if it's just "Lorem Ipsum" or actual, real content

Just some heuristics I'd use off the top of my head. I've had to do some technical DD in the past and there are always ways of determining legitimacy of claims.

The consequence of not doing even basic DD are outcomes like the $174m fraud that JPMC eventually discovered: https://www.theverge.com/2023/4/5/23671000/jpmorgan-frank-fr...