Here is a question. I run programs in the background all the time. They usually have nothing to do with Everquest. I know MQ does specifically modify memory used by EQ. Isn't it possible that other programs could accidentally be using this memory as well and set off a flag falsely?
Nope. Each application has its own memory space, this is part of how modern operating systems work. MQ has to invade EQ's memory space, and it does so by loading a DLL. If a DLL erroneously modifies EQ, it would erroneously modify many other programs, and would crash your system.
Comparing SOE's detection methods to FBI/CIA investigations is quite invalid. Each time you send a tell, or any other kind of message, this information goes straight to SOE's servers, and needs no deciphering. FBI/CIA/etc don't have that option. So if you send a tell to your buddy saying hey MQ is sweet I have this macro blah blah blah, they can have something set up on their servers to listen for that (heard of Echelon? this would be similar). The other thing is they could randomly be watching a player's text scroll by, and they can see [MacroQuest] echoes, etc (this is part of what the new chat window is designed to work around). And of course if you do some obvious macroing... too many combines in too short of a time for an average person will raise big red flags on the server end. This is even easier to detect than chat about MQ.