I have not reviewed the specification for Cardano private keys, but in many crypto-currencies a private key must have some specific characteristics, for example so many Bytes in size.
Because of the mechanisms used for generating addresses from private keys (usually at least one cryptographic hash function is used) even an invalid private key that does not have the right attributes (perhaps not containing enough Bytes) can be made to generate an apparently valid address.
This invalid private key to valid address cant be created in a standard wallet, but recreating address generation in some custom code, and just feeding it invalid private keys will give burn addresses.
Coins can be sent to a burn address, but because the private key is invalid, no valid signature can be created to spend the coins, and so they become impossible to move and are "burned".
An address can be proven to be a burn address by simply publishing the invalid private key with the address, and then anyone can validate the address is a genuine burn address.