1. check if the program indicates the encounter frame matching a lead, or if it just reports "X". Gen3 has vblanks which interrupt the RNG patterns, but oftentimes the lack of one will be extremely suspicious (but not provably illegal).
2. emerald saves the entire egg pid to the save file when it is generated. the other games only set 16 bits. the other random properties are generated when the egg is picked up, and technically someone could bruteforce all potential seeds to see if it was legal or not. but that isn't quick for programs to do in realtime.
3. pid%2. abilities are retained on transfer, but will change when evolved to match the ability bit (pid % 2).
4. cute charm activating just forces a range of PID values based on the gender. PKHeX calculates all possibilities while pokefinder probably doesn't handle it.
5. see #1. vblanks can interrupt, but they do not interrupt multiple times. sequential calls to the RNG are denoted A,B,C,D,E,F,G, where a vblank steals a letter and discards it. the game will resume, and won't see another vblank until 1/60th (or whatever) of a second elapses, which gives more than enough time for the pokemon to finish generating. Method 1 is just ABCD, Method 2 is AB-DE, and Method 4 is ABC-E. A vblank happening between PID calls has been observed, but it is extremely-extremely infrequent, so it's flagged as illegal just to make those cases obvious.