> The only real solution I can see is a dedicated logging server, giving true write-only or append-only access.

Yup. It's not that hard to setup, and while running it in a VM isn't as secure as can be, it's still a step in the right direction.