A thread called Open Source Quake Causes Cheating on Slashdot discussing John Carmack's .plan update from earlier (story) has inspired a post by John Carmack in which the id Software lead programmer goes into further detail about the situation (thanks Jacek Fedoryñski and King_Darius). Here's a short portion of the longer post where he discusses possible cheating countermeasures:

There are server-side countermeasures that look for sequences of moves that are likely to be bot-generated and not human-generated, but that is an arms race that will end with skilled human players eventually getting identified as subtle bots.

Media cheats can be protected by various checksums, as we do in Q3 with the sv_pure option. This is only effective if the network protocol is not compromised, because otherwise a proxy can tell the client that it's hacked media are actually ok.

If the network protocol is not known, then the extra-information cheats generally can't happen unless you can hack the client source.