So let's say they release their source code - how can they possibly prove that their servers are running that same code?

If the code was AGPL'd and included contributions for which DDG didn't own the copyright (so DDG would be using the code under the terms of the AGPL), they'd be breaking the licence terms if they failed to disclose any changes.

It wouldn't be proof, but it would be a fairly strong commitment.

at least for some functionalities, you can run it on your computer and observe the same behavior