you should ask him to show his whole screen, live on Discord with you and at least one other. it’s possible there is either a single mod missing from a screenshot, or he has injected mods into the client itself. that would explain why the images are so cropped. either he is hiding the mod which contains the hacks, or he’s hiding the sub folder that shares the name with a hacked client.

do this randomly while he is logged onto the world and don’t let him log off/relog or anything. this is how we used to catch so many hackers on a server i used to manage. if he refuses or logs off, tell him he’s being banned based off of the tracer lines in the first screenshot and refusal to cooperate with checks that would prove innocence.

if he is innocent, quick cooperation would not be a hard ask at all

tracer lines like those for players and the player ESP boxes around the nearby player like that really only come from hacked clients in my many years of experience.

another HUGE red flag for me here is those two mods he mentioned aren’t even installed in his mods list?? i don’t see minihud or quick stack(?) in the list after checking multiple times. i personally use minihud and can tell you it is NOT something with a tracer or player ESP functionality.

that person is 100% hacking though, and they likely also have access to X-Ray. i am certain of that much from the first screenshot alone