First of all xcheck is mainly used to draw attention to a player. If there is suspicious activity then an admin can watch them mine or when Nouv and I do it we track them to their mines and take a look around using logblock to find diamond ore deposits. Also very low iron and gold counts are suspicious. Most xrayers mine 30 or less iron and little to no gold. Ordinary players will gather nearly every ore they see.