The ghost software could be like this
it uses commands to calculate possible botters and associates and buyers like this
1. time spend on one spot
1.1. player total deaths and deaths on one spot
1.2. total loot gained, loot gained on same spot
1.2.2 player level, unused skill points, armor lvl, general skills based on player lvl
1.3. player route,same or not
1.4 player online time
1.5 guests done
1.6 player name
1.7 player ip
1.8 calculates total % chance him to be bot,
1.8 continues to phase 2
2. gained loot goes whom, what happen to it, where it were transferred.
2.1 what transfer method was used
3. actual gold buyer has been found
4. software greats data base what can be used identify byer/seller
5. Or makes auto-ban based on total %, what it has calculated of happenings.
and player/players will be send auto mail of happenings and chance to prove Zenimax wrong.