Metadata includes the time. And for the internet (as opposed to phones) they trace the whole routing through the net of each message to be sure they have the real origin, and then store that. There's a reason NSA buildings are so big.