There are obvious things they'll do and what they also somewhat confirmed.
First of all, cheating likely leaves traces on the server-stored / server-handled data. Take for example the unlimited fuel and unlimited jump range hack. When this is used it may well be that a player is in system X and then jumps to system Y, which is a longer distance away than the ship actually could jump based on its current jump drive.
Also, if he just jumped, and does not have a fuel scoop, and cannot have enough fuel for the next jump, this is also a clear indication of cheating.
It's probably a bit tricky to write scripts that detect these traces in the data, but it is possible.
Also, if a ship is in a combat zone, and accumulates a lot of vouchers, eventually running out of fuel, this is probably an indication of the unlimited shields hack, as they farm vouchers that way, while leaving the game unattended.
Other hacks leave other traces, and that way they can detect and prove cheating, and they do that regularly.
And then there are other measures in place, like moving stuff from client to server code bit by bit, and using encryption, store values at multiple points in memory to make cheating more difficult etc. But these are just the basics of what one could do.
