How do people know somebody doesn't have the private key to that [1BitcoinEaterAddressDontSendf59kuE] address all along and they're just sitting on the coins?
Because the person that created the address 1BitcoinEaterAddressDontSendf59kuE never had the private key. They simply started with the string "1BitcoinEaterAddressDontSend" and then added the correct checksum "f59kuE" onto the end of the string (it is a bit more complicated than that but you get the point).
Since
they never had the private key
no one will ever have the private key so any coins sent to that address are lost forever.