A quick draft timeline of events from an analysis of document meta-data and forum posts is below.
A number of domains, identified by Trend Micro as linked to a group of attackers known as APT28, were registered for use in attacks against Emmanuel Macron's campaign.
It suggests the edits may be following their theft, not before.
Before linking any individual to these attacks though it's important to note: Similar previous mail dumps have included a mix of real and fake information, and the Macron campaign have also said that the dump is a mix of real and fake documents.
This could be a legitimate timestamp of when they were scanned, fake information, or left in despite later edits.