Punkbuster kills all widespread cheats. There are some custom-made hacks, but they only work because very few people have it and they’re harder to detect. Any widespread hack gets owned fast.
The main problem with W:ET, however, is that ET cd-keys are too easily generated. This won’t be an issue at all with ET:QW, you’ll need to pay for every CDkey.
Even custom hacks can be dealth with, you just kick them by guid. (pb_list). Unfortunately some people are too lame to set up a server properly; I’ve seen a cheater gain referee status on a server and go on spree just because stupid admins thought more referees = better security. As it turned out, more referees = easier to find a ref who will share the password with you.
I don’t know the tools available to server admins, but if it’s possible to remotely give commands to a server, you can automate the kicking process by having an external shell script analyze server logs on fly. At least constant name changes are easy to nail down with pb_list, diff and so on.I don’t know if there’s a command to print number of headshots, but it will be very useful.