The Tor project provides public git records in their repository. So people can pull up who/when the code is written with a few commands. There's also the mailing list that you can read to learn more about why some feature is added. It's also where code review is happening.
To check if they really use the source code to build Tor. Tor supports deterministic builds. Anyone can build Tor with the same compiler as Tor uses and compare the hash of the output. If the build process is configured correctly yet the generated hash is different from the one Tor publishes. Then it indicated the published Tor binary is not built with the same source code. Which may mean the code have been tempered. Security researchers and Linux distributions routinely check for this. Any tiny differ will trigger alarms everywhere. In fact Tor does more than just hashes. All official Tor releases have a signature signed with a GPG key. Only the Tor project have the ability to make the signature (thanks to cryptography). Anyone else can't make a valid one and any modification to the file will cause the verification process to fail.
Also, security researchers all over the world are trying their best to hack Tor. - This is how security research works. If they found any vulnerability in Tor (including vulnerabilities put into Tor by let's say, governments). They notify the Tor project immediately then they publish their finding after (let's say) a year regardless Tor fixes the vulnerability or not. Tor is responsible to patch the issue or else they'll get hit by the vulnerability.
In conclusion. There's a lot of way to check if Tor is valid. From having no backdoors to making sure their binaries are actually built with the source code to confirming your download is not tempted with. And any security researcher will be the first one to scream when something starts to smell fishy.