How can Alice says she didn't encrypt a ciphertext, if Bob can decrypt
it using her public key?
This is due to the way how the underlying implementation works.*
For this purpose, every private key is an integer $d_A$ and $d_B$ and every public key is the multiple of the well-defined "generator" $G$, as follows: $P_A:=d_A\times G$ and $P_B:=d_B\times G$. This actually operates on Curve25519, but that's just a technical detail.
Now what the implementation does, is also called "static diffie-hellman key exchange". What this means is that Alice - in an honest execution - computes $K:=d_A\times P_B$, of which some deterministic derivative serves as the key. Pair this key with the provided nonce for XSalsa20**-Poly1305 encryption of the data and you're at it.
Now that we know the details, it's quite easy to realize how you can't prove who created the message, after all both would have derived the same static key and Bob could have easily faked all the associated meta-data to claim a message originally came from Alice - even though she never saw it.
* Or rather, how Bernstein imagined it to work. Implementations may do things differently but probably don't.
** XSalsa20 is basically just the linked Salsa20 with a larger nonce.