As someone who has obtained the shiny charm, and doesn't have pokemon bank, and never scammed anyone on the GTS; you just have to know how to use it. Find a pokemon that you can breed for one you can't, then continually trade up until you get what you want. I have 706 pokemon in my pokedex and I got almost none of them by searching the GTS, but by posting things for trade instead and waiting until they were traded. There are certain legendaries that I've probably had more than 10 of, it's just that I would always use them to trade-up for the legendaries I didn't yet have. Also I agree with the people saying not to trust what other people are offering, you might get lucky and they might not be lying, but I've even gotten scammed on Ditto's above level 50 that were claiming to have 4IVs (cause the level 30 6 IV ones are obviously all lies) so I don't think there's a single Ditto on the GTS that isn't a lie, and the one time I traded for another pokemon claiming to have 6 IVs and it's HA it had neither. The lesson is, if it sounds too good to be true, it probably is.
Also, per my experience the GTS does not block 6 IV pokemon. I have received 6 IV pokemon from the GTS before, and I even have 6 IV pokemon that I could offer myself just to test it. It would indeed be idiotic for them to block that, and that is why they aren't. I'm not convinced there's a whole lot of "hack checking" going on honestly, if any at all. Even though it would be reasonably easy to identify pokemon as hacks if they were really blatant (caught in an impossible area, or has move/abilities that the pokemon literally can't ever have) I would think this is the most in-depth they'll go with it though. If you're using AR half-competently or ID hacking or whatever, I'm sure they can't detect it.
And re: "Why are people asking for event legendaries when they can't be posted to the GTS in the first place?" The answer to that is because you can type in anything at all in the "looking for" field and it doesn't prevent your offer from being deposited. Once I accidentally offered Zapdos and I didn't want to, so when it came time to say what I was looking for I literally just typed in random letters that were complete gibberish, and it still deposited Zapdos. The only difference being that since what I typed didn't match the name of an actual pokemon, no one would ever see it as a search result. But because Darkrai, Mew et. all are actual pokemon names, they still show up if you manually enter their names. This even works with the as-yet unreleased legendaries like Hoopa. Maybe this means there are plans to be able to list them in the future, but I doubt it.
