Its a multipart piece of information you need to communicate.
First off, you provide the timestamp. That is what you validate against for the 'was submitted within 15 minutes'. Secondly, you have a hash of the timestamp with some additional salt. The salt is known only to you (on the server).
If the time stamp was altered, the hash of the altered time stamp + salt would not match the hashed unaltered time stamp + salt and you would reject the form submission.
This would look something like:
<input type="hidden" name="timestamp" value="2015.07.15.22:17" />
<input type="hidden" name="timehash" value="9BC54D13B43D456D9167DA13F2E8351B" />
Now, you validate against the timestamp. If you check the md5 hash of the string
2015.07.15.22:17somesalt you will find it to match the md5 sum
9BC5.... And thus you know the timestamp is valid. If the timestamp doesn't match the hash (with the known salt), then it has been tampered with.
I must point out that
somesalt not need be a constant for all pages generated. It could be a random number generated for each user session (and thus persists). Just that it is secret information that you hold and consistent for this user session.