Several ways:

Rime dictionaries, like qie yun 切韻, can tell us which categories were distinct at the time of the making of a dictionary, and which were the same. Some of those categories have descriptive names that help us understand their phonetic value: for example, he kou 合口 characters ("closed mouth") had labialized initial consonants. Examining the different rimes and comparing them to extant languages allows us to see which things merged, and which things split. This doesn't yet give us the phonetic value, but it allows us to group similar sounds together.

Examining the characters themselves should not be overlooked. Chinese characters are mostly a phonoideographic writing system, i.e. they encode both sound and meaning, albeit imperfectly. Examining the phonetic parts of characters can usually tell us about the rime, and the place and maybe manner of articulation of the initial (but not secondary articulation features like aspiration).

The comparative method as used elsewhere in historical linguistics is just as applicable to Chinese as any other language. Since there are many extant Sinitic languages, like Mandarin, Cantonese, Hokkien, Hakka, Wu, etc, we can compare these and reconstruct their protolanguage. In fact, we could do this even without any written records of Chinese, but they help us verify and correct our reconstruction.

Registers within character pronunciations are helpful in reconstructing different strata of language. This is especially prominent in Min languages, which diverged earlier than the rest. They tend to have 2 or 3 readings per character, sometimes more. These readings can be grouped into vernacular and literary. Vernacular readings are words that were inherited from Old Chinese, in the case of Min, and literary readings are words that were borrowed into these languages from later stages of the court language (Middle Chinese). These words are linguistic doublets (like English "cow" and "beef"), and they also help trace how the language changed through time.

Sino-Xenic vocabulary is an important piece of external evidence. Chinese was massively influential in the region, and languages like Japanese, Vietnamese, and Korean loaned thousands of words from it. They adapted them to their own phonology (for example, Japanese and Korean don't have tone, so they just sorta ignored that part), but otherwise didn't actually change them all that much. Comparing Sino-Xenic vocabulary to that of Sinitic languages is an important avenue of reconstruction. It also helps that all three have been using phonetic writing systems for at least a few centuries now.

Loanwords into Chinese can be another piece of evidence in our steadily growing pile. For example, transcriptions of foreign personal or place names. There was also an influx of Sanskrit loanwords into Chinese with the arrival of Buddhism during the Tang dynasty, and comparing the modern pronunciation to what we know about Sanskrit is useful. For example, Buddha is now pronounced fó tuó in Mandarin 佛陀, so we can see that voicing of the onset was reanalyzed as a rising tone, and there were additional changes in the vowels.

Other languages of the Sino-Tibeto-Burman family can be used to provide external evidence. Finding cognates in these helps reconstruct the evolution of Old Chinese, and specifically the state of the language prior to tonogenesis. Because Old Chinese didn't have tones. Go figure.