You can get clues by looking at the title and description returned by the query on an engine and compare that to the meta's that you get when you follow the link.
You can also look at the size of the file and see if that differs from the returned page.
If you notice a difference it is possible that the page was cloaked, it is also possible that the page was switched once the high ranking was achieved, or just good old honest updating that the engine hasn't caught up with yet.
Other giveaways can be many different listings that all point to the same page, or many subdomains that bring you to the same index page. Although these would not necessarily confirm that a site is cloaking but they are indicators.
I don't believe that there is any way to break into the code or any cloak sniffing script, maybe Brett or Air can confirm that.
I believe that cloaking is nearly impossible to detect if it is done well, and easy to spot if done poorly. In between those two extremes I think all that you can do is make an educated guess.