How the Creation-Date and Modification-Date parameters are populated is implementation dependent. You can read more about this here:
For instance, an email client might leave those parameters unpopulated, read the file system timestamps of the attachment and populate them accordingly, or populate them with the date/time when the files were attached to the email.
Something to be mindful of, especially with RFC822 attachments, is that the Creation-Date and Modification-Date parameters might be populated to reflect when the attached message was forwarded. I can reproduce this in Outlook by forwarding an older message with the “Forward as Attachment” respond action. I get a message/rfc822 attachment and the Creation-Date and Modification-Date parameters are populated with the date/time when I forwarded the message.
I would recommend testing with the specific email clients that were involved in the conversation if possible.