installation time

Why would the timestamp of an install event come before the user’s date first seen?