Every property of a humanoid is accessible on the server. Although, Humanoid.TargetPoint is only changed on the client. (it is also the reason many old weapons/tools only fire toward the origin)
Scripts in general can see changes from other ServerScripts most of the time, depending on the replication of a certain property. The only time changes can’t be seen by the server is when a LocalScript changes a property.
If the client had changed properties of a humanoid, the server would not be able to detect the changes, but if the changes were on the server, yes.
A local script to detect the changes, but that won’t be very effective as the exploiters can delete it. The second best option would be a server-sided anti-cheat, but even then, that won’t help too much as they can be very wrong or very right.
Adding on to this, really the only thing you can do on the server is check the distances to see if they aren’t extraordinarily large. As he also stated, it’ll false positive some of the time.