We’ll have to wait and see what information the accounts trigger will provide, but I believe that account activities will be very useful in determining whether the change came from IDN or the source.
For example, if you receive an account created trigger event, you can cross reference the identity the event applies to with the account activities API. I think if the requesterIdentitySummary is null, then it’s likely that the account was created directly on the source, but you’ll have to test this theory to make sure it is valid.