I tend to spam the hell out of my nuke button when I'm playing a single character, let alone when multiboxing and I know that they aren't quite perfectly in sync. Manually spamming the button certainly does not get around the GCD, but I'm sure I'm within 200ms of it at most. I would think it would be difficult differentiate this from a cleverly programmed automated system. I know there is a way for applications to differentiate between keystokes raised by hardware and by software, but of course all the key presses keyclone sends to the clones are raised by software and those are considered legit, so that's not really a safe way to tell a bot.

Perhaps going into too much detail on how they detect bots isn't a good idea anyway, since it may give those with nefarious motives information to use to go undetected.