There are several ways to tell if a Pokemon is legit or hacked.
1. The kind of ball its caught in
2. The OT (for events)
3. The ID (for events)
4. The stats
5. The ribbons
6. Location
1. If a Jirachi is caught in anything besides a Pokeball or Cherish Ball, it's automatically hacked because there is no way it can be caught in anything else besides hacking. Deoxys and Faraway Island Mew are harder to determine if they are hacked or not because they can be obtained in-game. However, you had to go to a special event in order to recieve the ticket which allows you to catch them. So some people could have gotten them through legitimate means, and others could have AR or Gamesharked them. Faraway Island Mew are always Japanese because the event never happened in English versions of the game. So they are easier to recognize. Also, if a normal pokemon is caught in a Masterball, there is suspicion for either the Pokemon to be hacked, or the person hacked to get tons of Masterballs.
2 and 3. The OT and ID is probably the easiest way to tell if specifically an event pokemon is hacked. If a WISHMKR Jirachi has an OT and ID different from OT: WISHMKR ID: 20043, it's hacked. Pokesav unfortunate can easily replicate the event by inputing information onto the computer and downloading it onto AR, making it look legit.
4. If a Pokemon has IV's that exceed 31, it's hacked. Pokemon Battle Revolution turns all Pokemon that's IV's exceed 31 into Bad Eggs, making it easy to determine if it is hacked or not.
5. If a Pokemon has a ribbon that it cannot possibly obtain normally, it is hacked. Any normal Pokemon with a Classic Ribbon is hacked.
6. If a Pokemon is caught in a Location that it cannot normally be encountered in, it is hacked. Pal Park has made it even more difficult for this by simply saying it is from Hoenn or Kanto without giving a specific route.
Hope this helps.