Just to check my understanding, as well, it seems that Hacking is a no no (and for me personally, a big one), and the number one way to check it is via Pokecheck, though that is by no means a guarantee. In the same way that a very well done counterfeit can pass as legal tender, and using it isn't inherently doing something wrong (it's legal tender for all intents and purposes) and the only person actually guilty of wrongdoing is the person creating it, if a hacked pokemon escapes your notice but ends up being traded to someone else who catches it, as long as you seek to rectify the situation you're probably fine. On the other hand, creating such monstrosities and trading them or failing to rectify the situation when a hacked pokemon is discovered will get you in trouble.
Conversely, cloning pokemon is not just acceptable to some members of the community, it's understood as a normal practice for those who want to collect event and legendary pokemon, though you should make sure the person you're trading with is aware the pokemon in question is cloned and is ok with that before proceeding with the trade. When dealing in cloned pokemon setting rules regarding redistribution (redis) is doubly important, as (eventually) having dozens or more copies of a pokemon floating around with someone's OT can get them in trouble. Go figure, the same resource, pokecheck, appears to be the easiest way to clone a pokemon as well.
Does all that sound about right?