Are there other ways of finding out where commits originate?
The use case here is trying to figure out if a contractor is outsourcing the work to other / cheaper labor.
If this is the direction you want to go, the only way I can think of determining this is by telling the contractor to use a github account you control and then monitoring the logged in sessions.