With advanced tooltips on, real join or leave messages have information that appears while hovering over them (name, type, UUID) while fake ones don't have any hover information.
Real message:

Fake message:

I don't know Java code but I do know that the following tellraw command creates a message that is indistinguishable from a vanilla join/leave message:
/tellraw @a ["",{"text":"(PLAYERNAME)","color":"yellow","hoverEvent":{"action":"show_text","contents":[{"text":"(PLAYERNAME)"},{"text":"\nType: Player"},{"text":"\(UUID)"}]}},{"text":" left the game","color":"yellow"}]

If you swap in the UUID and name of the vanishing player it creates this: