Since the paranoia seems to surround the theoretical possibility of Flarm leeching, here is a suggestion: I believe you may be able to determine leeching (provided someone can define it) by using the Flarm IGC file. In it are comment lines which enumerate each Flarm contact. I'm not sure if I am decoding these correctly but it seems as though the received Flarm is identified uniquely. To leech in the way that is the source of the paranoia, one would need to keep in Flarm contact throughout the day. This should be quite apparent from an analysis of the contact comments, perhaps in combination with the position reports to see who is leading and who trailing. Some definition of leeching would need to be proposed based on leading/following, % time in contact, etc. There is no information there that is not already contained in the relevant IGC position data, but it is easier to process, and adds proof that the target of the leech was in Flarm contact (which must be part of any Flarm leeching by definition).

Note that the same thing can be done for ADS-B, at least with Mode S transponders and a PowerFlarm log. It would flag visual leeching as well, since visual leeching is a subset of Flarm leeching.

All this appears to be technically feasible, except perhaps for the definition of leeching which has so far been elusive. The log checking can be an automated part of the scoring process, or applied in the event of a protest.