This is a list of reasons why a Pokémon would be considered hacked by someone. These things are relatively easy to check/notice. Remember, Bulbagarden has its own Wiki which you can use to check movesets and event lists.
The GTS has a somewhat accurate hack check system, but it is not perfect and can be fooled. Getting a Pokémon from the GTS does not guarantee that it is legit.
NOTE: This list is not foolproof and it is still possible your Pokémon is hacked even if it passes all these tests.
~ illegal move
~~ a move that cannot be learned by any means by the Pokémon
~ illegal moveset
~~ a combination of moves that cannot legally be bred/learned together
~ illegal Poké Ball
~~ Wild Pokémon can be caught in any ball but event Pokémon are in Cherish Balls or Poké Balls and starters can only be in Poké Balls (except for the Johto starter evolutions from Colosseum and Dream World starters)
~ illegal location data
~~ a Pokémon caught in a location that it cannot appear in is not legit
~ illegal level
~~ Pokémon have a certain level at which they cannot be below. All single stage and first stage Pokémon can be as low as level 1 but most evolved Pokémon must be higher level than that.
~ illegal ability
~~ Pokémon only have at most three abilities (with the exception of Basculin who has four). If the ability shown on the Pokémon's summary is not one of those three, it is hacked.
~ non-event having event-only ribbons/moves
~~ Only event Pokémon can have their event Ribbons and moves. Unless the move is breedable, you won't find a Pokémon with that move and without the Ribbon.
~ shiny event Pokémon that aren't preset as shiny
~~ Pokémon received through Mystery Gift go through a shiny check and are always made to be not shiny unless they are set to be.
~ illegally shiny
~~ Currently, only Arceus, Victini, Zekrom, and Reshiram cannot be shiny. The Zorua and Zoroark obtained in the Celebi and Crown Beast events, respectively, as well as Pokémon obtained in the PokéWalker or in Entree Forest cannot be shiny either.
~ not currently available
~~ Right now, only Keldeo, Meloetta, and Genesect aren't available due to them not having an event
~ Some Pokémon haven't been released in the DW yet
~~ No Unova Pokémon (except Musharna and Darmanitan) can be found in the DW yet.
~ Certain DW Pokémon cannot be female
~~ The Dream World events Chlorophyll Bulbasaur, Solar Power Charmander, Rain Dish Squirtle, Poison Touch Croagunk, Shell Armor Turtwig, Iron Fist Chimchar, Defiant Piplup, Unburden Treecko, Speed Boost Torchic, Damp Mudkip, Super Luck Togekiss, and Thick Fat Mamoswine are all male and cannot pass down their ability.
~ previous generation ribbons
~~ A Sinnoh or Unova Pokémon from Gen IV or V respectively cannot legally have ribbons from previous Generations
~ wrong language name on an unevolved Pokémon
~~ When foreign Pokémon evolve, their nickname will change to whatever language game they are in when they evolve. Unevolved Pokémon cannot have a foreign name with a not foreign Original Trainer
~ disappearing nickname upon evolution
~~ indicates the nickname flag hasn't been set; foreign names must be taken into account
~ Pokémon with egg moves in non-Poké Ball
~~ Pokémon with egg moves can only be in a Poké Ball
~ Pokémon can't keep HM moves when being transferred from Gen III to Gen IV or Gen IV to Gen V
~~ Pikachu with Surf and/or Fly can't be transferred to a later generation
If you have any questions about whether or not your Pokémon is hacked based on this list, feel free to ask here. There is also a "Is My Pokémon Hacked?" Thread in the Video Games section if you want someone else to check for you. Again, this is not foolproof.