It's actually pretty hard to create convincing email headers across thousands of emails.

Many of these highly eyebrow raising emails are CC'd to gmail accounts, for example. If it was fake, you could ask Google for the logs to prove at least it wasn't received.

And if there are DKIM headers, then that's certainly strong evidence that the header and body are legit.

Most leaks that I've seen are not PSTs with full metadata.

The whole problem with this sort of thing is that there's no chain of custody.

The web interface does show some of these things, but I think with Wikileaks you can always get a torrent of the raw files they've obtained. At least, that was usually the case. The DKIM information is verifiable, and if Wikileaks was overtly fabricating something, people would love to be able to attest to that fact. Hillary Clinton could say that Wikileaks is overtly lying, but doesn't, because there are multiple ways of verifying this particular leak and it would be nonsensical to try to outright deny it. Instead, she tries to Putin her way out of any discussion involving this. Do you think she would do that if she could just deny?

You'd never fake thousands of emails. You'd fake one email and insert it into a set of thousands of real emails.

Well, you can start by denying it. But as far as I know, nothing wikileaks publishes really ever gets denied.

If the people don't deny it, then it should be assumed to be true.