legal hasn't been updated in a long time and is only reliable for the most rudimentary of checks. your friend is completely wrong. i did 2 manaphies. the first was "traded" via pokegen and has "pokemon ranger" listed as the met location. the poke is legit and rng-ed fine, but because it didn't move ds to ds, the met tag didn't update properly. i did a second one and traded it from my dsl to dsi and it has the proper met location of "link trade". the one that says "pokemon ranger" comes back as the pokemon ranger manaphy in legal, which is wrong. it should just come back as "hatched" since it isn't listed as being from pokemon ranger anymore in the met data. if your friend is seeing anything about it being hacked she's either lying or using an old version of legal. i would bet on the latter. i just checked the old and new ones myself and neither comes back as hacked. i've had quite a bit of conversation about this with someone who used to hack check quite a lot(maybe still does?)from pokemongts and he's in agreement with me along with kaph and quite a few others, so.. yeah. if she wants to talk about it, i'm easy to get a hold of and i'm sure i can answer her questions.
just to make it clear for everybody: ALL SHINY MANAPHIES FROM POKEMON RANGER SHOULD BE LISTED AS "HATCHED" IN LEGAL.EXE. IF THEY ARE NOT, THEY'RE LIKELY HACKED, BUT NOT NECESSARILY. if their explanation isn't the same as mine for why their manaphy is listed as "pokemon ranger manaphy" even though its shiny, then it's definitely hacked. one of mine is listed that way because of an accident, as explained above, but it was rng-ed normally.