You could presumably find out, by looking at the IP addresses those workers are connecting from? If there are clumps of machines coming from the same IP address or IP block, it is probably a farm. If they are all individual IP addresses from all over the world, almost certainly a botnet?
A valid observation which would work with some heuristics in the code to differentiate them from many low power miners or many rigs with the pool set up as the final backup. But then nothing would stop him simply pointing each rig to a different address. I'll look into it anyhow.