Yep, GitHub contributor matching is well-known for not being a proof to anything.
It is simply a handy way to see what is being
claimed.
You want proof, look for commits signed with a GPG key, but you usually won't find those outside high-profile repositories. e.g. The linux kernel has signed commits/tags.
Apprenticealf seemingly has a GitHub account, and used it to create an empty repo.
