[fumer]

> Just to make sure I understand correctly... the most compelling piece of evidence for you is the timestamps on the files?

If I understood it correctly, the most compelling evidence was the real data transfer rate of those emails, deduced from the file timestamps, which ruled out their provenance from the server.

> Something that's not only trivial to fake (...)

Well, in this case that would go against the original accusation, therefore it would either be pointless or the explanation would require a conspiracy with double agents planting fake compromising evidence.