Thinking about this issue has come up with two ideas. One, log into the users calendar and check the properties. This will at least show the last modified date on the appointment. Problem with this is, this will not prove what date the appointment was created, only show when the last change was made.
The other option is we could do a restore to the calendar to see if the item was entered in before the nightly backup fired.