Of course you can doctor logs, but in my experience most people don't. Heck, they don't even deny saying what they did. It's always just "But I didn't mean it like that..." or "But he/she led me on..." or "But I thought they were cool with it..." or something like that. Yes, there are genuine malicious harassers out there, but there are also a lot of people who just lack self-awareness. So you tell them "Well it's not cool so knock it off" and hopefully that's the end of it.
To @Auspice's point about the web portals... yeah, they don't log (though I think the Cheese WebMU does) but you don't need to capture a whole log. Just when it happens, copy/paste into a mail - either to yourself or to staff depending on severity. I would think this could work even for @GangOfDolls' scenario about not storing anything locally.
Worst case for a persistent offender is setting them SUSPECT. Not to just randomly snoop on them, which I would never do, but for the sole purpose of verifying the authenticity of a log that's in dispute. Obviously this will only help if there's a "next time" - you can't retroactively do it.
I'd think privacy concerns preclude any sort of pre-emptive log protection like @Arkandel is talking about. I'd considered a similar system where pages and OOCs were put into a temp buffer and you could generate a log automatically from that for reporting. But I think anything like that would freak MUSHers the heck out. It's a tradeoff between privacy and security.