Sadly, its pretty hard to tell if the pokemon in question is hacked or not. Any hacker worth his salt can make it look absolutely legit. You can change the ID, hidden ID, stats, iv's, ev's, nickname, level obtained, place found, date found, egg hatch date, egg hatch location, country obtained, moves, pp on moves, nature, friendship, hidden value, original trainer, the game which it was caught, ribbons, how many steps it took to hatch, pokeball caught in, ability, fateful encounter, shiny, condition, pokrus... etc. For all intensive purposes the pokemon IS legit. It's not some weird magic that puts it into the game lol... the AR simply manipulates the game's coding into creating that pokemon.
It would be pretty hard to figure out if it was hacked or not... you would need a flash card version of pokemon in order to export the saved game data in which the "hacked" pokemon resides(you are unable to export your game data using the AR pokesav method) into pokesav. Then it gets really hard :P. If the hacker doesn’t know what he’s doing and puts 999 in all stats, gives it max iv's, puts illegal moves/abilities or doesn’t have the right encountered information... then sure its going to be easy to tell if its hacked or not.