[Kobal2]

Found that AAR again. Apparently the guy had filled out a recruitment queue far beyond the resource capacity of his castle for some reason. On the next turn he decided he needed the gold after all and cancelled the queue, which the game interpreted as having pulled gold out of a hat.

So yeah, the cheat detection can wonk out, I wouldn't worry overly much about it unless it happens to the same person multiple times or something. If you're really concerned the guy might be really cheating however you might ask him to send his last and current turn file to a third party who's not in the game for a check.