Sure they can. You find a dev working on that project and say "Hey, can you make your git repository public so I can push some commits to you?" As far as
git (not GitHub) is concerned, every local copy of the repository is just as much the "true" one as the one hosted on GitHub, and you can push commits to any of them, which will get merged in when a GitHub committer pushes to GitHub's remote.
I was doing some analytics on various crypto projects on GitHub, and was surprised by the number of them that had authors without GitHub accounts. These show up in the commit API as having 'author' and/or 'committer' as null (the commit itself has an author that's whatever you set your "git config user.name/email", which may not be a registered GitHub user). You have to handle these cases or your analytics script will crash very soon, because it's a pretty common case.