They were just using PKHeX, along with smoke and mirrors to think you were getting anything but that.
PKHeX only omits certain checks (like Gen6+ mystery gift version checks) due to lack of serialized data that can be used by the program. I don't think they were even doing that.
They might be checking for plausibility, which is in between legitimacy and legality.