So much misinformation...
Yes, Sony does have code in place that validates the client/server communication integrity. Anything mucking with the datastream or the local client and making it execute invalid commands will send up a red flag in Sony's logs. This code has been in place for months now and if you've warped, ghost killed a mob or transfered NO TRADE items, then you're almost certainly in a log file somewhere. Over this time, Grumbuk and possibly others have been manually reviewing these logs, investigating the people in them and tweaking the detection code to eliminate false positives and refine what it can detect. There have been approximately 1000 bannings over the past 2 months with minor offenders simply being warned.
Once the powers that be are happy with the detection code and feel confident that it isn't flagging innocent people, then it will begin to automatically and instantly suspend accounts. Warp somewhere with MQ, or anything else for that matter, and you'll go LD and come back to a message that says your account is suspended and to contact Customer Service. I'm almost positive that this code has not gone live yet, but Grumbuk is probably just passing sections of his logs over to CS for suspension. Since Sony has no interest in needlessly losing customers, all but the most severe cheaters will get a warning/suspension or two before being permanently banned.
I've spoken to Grumbuk in person about this, this isn't some 3rd hand knowledge.
----------
Based on talking to the devs/coders and what I know was already in place, the following are true.
Sony is not and will not scan your machine for anything other than what is required to patch the game and some system info if you've checked the box allowing it.
Sony can not detect a piece of software running on your box, so long as it isn't actively meddling in the EQ memory or data stream.
Sony can not detect macroing that merely feeds input to the client application through DirectX input, although these still violate the EULA in most cases.
Sony can not detect a program which sniffs and decodes the EQ datastream, although these most definitely violate the EULA.
Sony can not detect and have no interest in programs that read the EQ log file for information/alerting purposes [i.e. EQWatcher]. These programs do not violate the EULA.
Sony can detect macroing or a 3rd party application that modifies the data stream or fiddles with the memory in the EQ application.
Customer Service requires proof of somebody cheating/hacking before they will suspend them. These logs are more than sufficient proof, they will not be manually investigating them.
Unattended macroing is a violation of the EULA, but requires manual investigation because it is hard to detect. It will most likely never be subject to the auto-ban code, but certain repetitive actions can be detected and flagged. Expect the GMs to have a little extra time to investigate them though, since they won't have to deal with hacks anymore.
If you're actively using a 3rd party program to hack EQ now, then you're already in Sony's logs. If you haven't been suspended, it's only because the auto-ban code isn't live and because Grumbuk doesn't have the time to manually investigate everyone. Once the code goes live, you will be instantly and automatically suspended if the code flags you.
--------
Sony will probably never truely kill MQ and the truth is, they don't have to in order to be successful. If they eliminate the most blatant abusers and make it too risky for the average person to use, then it will slip into the shadows. People will still continue to macro with it at some moderate risk and I'm sure a few enterprising people will even figure out how to circumvent the detection code.
