This plugin was created to fulfil this request, and has been uploaded here so everyone may use it (which was also requested)
SayLegit is a simple plugin that tries to stop some people who use hacked clients from playing on the server. Most popular hacked clients use the same system for commands - a dot followed by the name of a feature is normally used to toggle a feature on and off. Because of this, SayLegit forces the player to type ".legit" within the allowed time (configurable) or they will be kicked. If they are kicked a number of times, they will be banned (also configurable). The legitimate players will have no problem doing this, but the hacked clients will normally stop the player from saying this, as it will be run as a command, resulting in them being kicked.
This plugin does not feature commands - should it have any?
saylegit.bypass - Players with this permission are not forced to say .legit
Source will be available on GitHub soon. Most likely here.