I expect that in most cases we'll be able to tell from the code. In cases where we can't tell we assume that people made it themselves. We are releasing the code to make EE easier to work with (having private repos and docker images is hard). We did not want to make it harder to contribute EE features to CE. If people are worried about poisoning please let me know. Merging EE functions into CE has always been at the discretion of the core team, we don't need any excuses.