In my opinion, it would take someone very experienced and very passionate about trying to prove that a box had been connected. First of all, note that the way all currenly marketed boxes operate is to let the ECM do all the work -- analog inputs are fooled and the ECM just reacts to those inputs. All inputs are within factory maximums and the ECM thinks it is operating within those limits. If that were not the case, boxes would set codes.
I still say that the most compelling evidence of a box is physical (connectors, velcro, dust patterns, whatever). the only way an experienced and passionate engineer would know is for the ECM to keep a long history of analog input values (not likely, there's not enough RAM to keep more than a few seconds -- just my opinion here). Assuming that the ECM keeps enough history they could look at:
1. boost history. repeated maximum boost levels of precisely and exactly the same value would suggest electronic boost fooling.
2. low fuel pressure readings and trends inconsistent with high boost. pressure boxes tell the ECM that fuel pressure is low so that the ECM will raise pressure.
thats all I can think of at the moment. maybe timing signals from cam or crank.
I just don't think the ECM is capable of retaining that much data. and even if it were, as I say it would take a very experienced and very passionate individual motivated and suspicous that a box had been present.