How do I verify that a visitor really is Googlebot?

Do not take the name at face value. A user agent is a claim, and some traffic puts Googlebot in its own string hoping for softer treatment. Google publishes the means to confirm whether a request genuinely originated from its crawlers, and that check is the right way to settle it before you either trust a visitor or block one.