Wall hacking is, indeed, difficult to spot. The main thing that I look for is a consistent pattern. I would never vote that someone is hacking on only a few instances in a long demo. I would, however, take more demos and look at them and see if there are any more instances. I would definitely expect a wallhacker to consistently round corners and anticipate the enemy. There may be some tracing, but for me, that's not a reliable source unless it's constant, because an experienced wallhacker would never trace..or atleast purposely..because they know it's a dead giveaway.

I would look at any fishy instances and try to pull the ghost hunters theory. I would try to debunk it before I jump to conclusions. If there is no logical (radar, sound, previous firefight that could have been heard, etc..) reason that the person in question got the kill..then it could be conclusive.

The great thing about SourceTV is that, if you expect someone..you don't have to view them directly. You can always pull a demo from when they think nooone is watching..and they're more likely to slip up!