I really don't know. If I truly suspect a h0x0r, I record a demo for admin submittal. I have only done this twice, but the due process brought swift justice.
Really though, if someone is suspect, it is good practice to get a demo for some tangible proof rather than tossing around subjective accusations.
I'm not trying to be a dick, I just feel that multiple sets of eyes analyzing a demo will yield highly acurate results.
/$0.02