Perhaps implement a way of reporting occurences like this in-game? The same person is still putting hacked pokemon up on the GTS (the latest was an espeon that knew earthquake, with wonderguard as an ability and -11% exp. in level 3 -.-), and offering possibly hacked pokemon on other people's trades. 
You don't even need to hack the stones itself. Just get the pokemon. Script files should be locked. And it's a miracle items (as far as I know) can't be hacked so easily, because then you could make Potions heal 200hp.