This has nothing to do with GitHub. The commit author field in Git is like the “From” field of an email; you can put whatever you want in it.

This has everything to do with GitHub.

Git provides mechanisms to sign both commits and tags, and to verify those signatures. GitHub fails to make use of those mechanisms.

I think it does. Github is an open system, whereas if you host your own Git server you can ensure that only trusted people have commit access to it.