Not sure if this is exactly the right thread to ask this, but the SQSR thread forbids discussing hacks and google isn't turning up an answer, so:
Just got wonder-traded a shiny event Diancie. Obviously auto-assume to be hacked since,
despite all the details looking right,
it's a wonder-traded event mon (with perfect IVs). But what I can't figure out is how it went through in the first place because unlike most WT'd event mons
it still has the classic ribbon attached. It is also holding its mega stone, which as far as I know also can't be wonder-traded.
Any idea how this was possible? (If answering the question would break a rule, let me know and I'll delete)
I can only speculate here since I'm not familiar enough with hacking methods (nor do I really want to know more) and I can't see the script for this specific Pokemon. But there are two conceivable methods in which a Pokemon with an illegal ribbon could be transferred.
The first possibility (and most likely in my opinion) is that the sender is using a WT script that allows them to bypass the hack check with WT. Most mass WT peeps use some bot or script that allows them to continuously send out Pokemon. This allows people to possibly manipulate how the handshake occurs between the devices and the server (as they are using some form of hombrew). If (as I suspect) the legality check occurs
before the Pokemon is set up for a possible transfer with another individual in WT, the server probably query's the device first to get data to determine legality, but doesn't actually extract the Pokemon's data for transfer quite yet. Thus, it's possible whoever WTd the hacked Diancie inserted some script that returned false data to server to give a proper handshake with the server and spoof the hack check.
The second (and significantly more speculative) possibility is that the Diance does not actually have the classic ribbon attached (or did at least not have it attached when it was sent). If through some script editor you were able to directly manipulate all lines of code for a Pokemon, you could take the data of some other ribbon, and edit it so that it used the image and text files of the Classic Ribbon. Thus, the ribbon would still read as a legal ribbon but it would appear as a Classic Ribbon to the user. Of course, this would depend on what level of data is copied from each Pokemon when it is transferred between devices. I don't know how data packets are actually transferred between devices during trading, as it's entirely feasible that it just copies the key surface markers of a Pokemon and transfers those without actually transferring the Pokemon in its entirety, which may make this process impossible.
Honestly without being able to look at the code for this Pokemon and without knowing more on how all the back-end mechanics work, it's hard to determine. Your best bet would be to go try and query non-Smogon forums that have a prolific hacking culture (though I probably shouldn't be recommending this) and ask, since they would have a better understanding of how much of this works.
Edit: It's also entirely possible that the servers don't do checks before transfer anymore, and they just rely on the built-in checks for each game, in which case it's fairly easy to disable the check script from running. But again, Idk how the back end stuff works.