The details will vary based on your locale, but I'm answering this assuming your locale is a party to the Berne Convention (since most are).
What prevents Alan from copying our private code and pasting it on
GitHub as his own 'published work', essentially granting him copyright
over our work?
This would not grant him copyright in any way. Publishing something does not give you any rights that you didn't have before you published.
What legal standing do we have (or proof) if we have not made Alan
sign any documents specifically saying he is not allowed to publish
our code anywhere (but we also haven't signed any document saying he
IS allowed to publish our code).
As the author of the code, you hold the copyright and all rights to the code are yours alone. You don't technically have to get Alan to sign something saying he isn't allowed to copy the code. The default position is that the only person allowed to copy, modify, use, distribute, etc. a copyrighted work is the copyright owner. The purpose of a software license is to give someone else limited permissions to use the copyrighted code. If Alan can't produce a valid license showing that you gave him permission to do what he did, then what he did isn't legal.
Is it proof enough that Alan posted the code at a given time
first(which was verified through something like Github's signature on
the commit) that I cannot file for a copyright?(since he has published
his code and gotten it verified, but we did not used 3rd party signed
commits)
Publishing or posting something is irrelevant to copyright ownership. The author of a work automatically owns the copyright as soon as that work is "fixed" in a medium (meaning, as soon as it's printed on paper, saved to a file, recorded, etc). You don't have to publish it or register anything, it's completely automatic. If I hack Steven King's laptop, steal an unreleased manuscript, and publish it, Mr. King still owns all of the copyright. I can't take ownership of the copyright unless the copyright owner voluntarily transfers it to me.
Also, a signed Github commit verifies that the commit hasn't been tampered with and that the committer's identity hasn't been spoofed. This is useful from a software security standpoint, but is completely irrelevant as far as copyright goes. A "verified" commit doesn't indicate anything about whether the committer had the legal right to use the associated code. This is good for you, because now it's a whole lot harder for Alan to defend himself by arguing that someone else committed the code and made it look like he did it. The act of distributing the stolen material is stamped with his verified identity, which makes your lawyers' jobs easier.
I have a feeling you might be confusing copyright and patents in a lot of this. Copyrights are automatic and publication and registration are optional and irrelevant. Patents, however, must be filed and awarded, and many locales have a "first to file" rule. It is possible for someone to steal a design and patent it before the rightful owner can do so. Such a patent (if it was granted) would be completely invalid, however, and you could get it overturned in court or by an appeals process (plus sue for damages). Software generally isn't patented - and in some locales cannot be patented - so this likely won't apply to your work.
Backdating commits won't really help Alan. As you mentioned, commit logs can be forged, so they're unlikely to be given much legal weight. Github's server logs know when the repository was created and when the code was pushed to the repo, and this information would be much more trustworthy in a legal case since it comes from a disinterested third party. You also have the sworn testimony of everyone else who worked on the code base, plus indirect evidence like email threads discussing the code, reports showing screenshots of test builds, etc. that can't be faked as easy as a commit log.