Account creation may be logged. Under Linux (if using the common shadow utility suite), useradd makes a log entry under the facility auth.info. This log is typically located in /var/log/secure or /var/log/auth.log (it depends on the distribution).
You can check your backups of /etc/passwd and see which is the youngest backup that doesn't have this account. I use and recommend etckeeper to keep track of changes in /etc, so git annotate /etc/passwd would give me the answer. (Actually git annotate would tell me the last time a user's entry was changed; a bit more digging whose automation is out of scope of this answer would tell me when the entry was added.)
If you lack audit logs, backups and revision history, you'll have to resort to heuristics. A good clue is the file whose inode change time (ctime) is the oldest. This heuristic can lie both ways: if a directory is moved into the user's home, it may contain files with an old ctime (but for them to be older than the user, their uid would have not to be that of the user as a change of uid involves updating the ctime, so you can skip those files that are not owned by the user); conversely, some events can change a file's ctime (e.g. if the whole system was restored from a backup). You can start from the user's home directory (ls -Alctr ~bob | sed -n 2p), which might contain files from /etc/skel that the user has never modified (.bash_logout is a common one), and see if there are older files with find ~bob ! -cnewer ~bob/.bash_logout -user bob. With zsh, run ls -ld ~bob/**/*(Doc[1]u:bob:).
/var/log/auth.log(you may need to look in the rotated logs as well:/var/log/auth.log.1,/var/log/auth.log.2.gz,...). This will give you a clue as to the first date the user account authenticated. This will not work for system users, though, and will also fail if the accounts were created a longer time ago than yoursyslog's log rotation period./home/user