I suppose ps.viewangles of the suspect and s.origin of whoever he's looking at would be a good sign - if it stays on that point for more than 1sec while either are moving it might be recorded. Still, this would waste some CPU and RAM with not that great a gain - aimbots generally are pretty obvious.