Heh...
Its pretty simple to be honest ... Case is how to gather all, prepare and read
An example of final files I get for each player - for as many days of composing as I wish...

This one looks like pretty normal composing times

This one is 100% proving that someone was using autocomposer heh
How?
In your server folder:
GameServer\d_log\2008-12\sacrifice year-month-day.log
are accumulating all info you need about each compose made in game...
Code:
~XXXX~[14470516] eudemon[id:2017370020][type:1071980][star_lev:3031] [2012393354] 2009-11-10 00:05:11
~XXXX~[14470516] eudemon[id:2017370017][type:1071980][star_lev:3029] [2012393354] 2009-11-10 00:05:29
~XXXX~[14470516] eudemon[id:2017370012][type:1071980][star_lev:3027] [2012393354] 2009-11-10 00:05:42
~XXXX~[14470516] eudemon[id:2017370010][type:1071980][star_lev:3020] [2012393354] 2009-11-10 00:05:55
etc etc
To prepare work materials:
Copy whole content from for example whole day of sacrificing eudemons (whole txt file) into your excel sheet (it can take a while ... mine files are over 6mb so its lots of data...)
Now lets filtr little these information
Put an autofiltr on ALL data inside sheet - so you will be able to chose only certain players you are interested in...
Now ... On max right side you see certain times for each composition. We just need to make one more column that will show us time differences between each of them
Lets do this for example in my copied excel:
=E20-E11
and now extend this action into whole long column - so you will see loong list of time difference only...
no you can copy these numbers from up to down and paste inside html file to see all timings like in my examples.
Now how to spot? Mostly macros, autocompose programs are making similar repeats, sometimes compose time is even lower then 5s (4s is possible to make - but to be honest if its to often its not normal and should bring suspections at least)...
I believe the rest is up to you people
Regards