It is not just the content of the answer that suggests something is odd about a student submission. The context and data around that submission can also raise concerns.
There may be system or application data that suggests something unusual has occured.
The information that a word proccessor can show about submission document can also indicate anomalies.
A Word document containing a student submission of a TMA contributing 30% of the overall assessment on a module was found to have the following properties:
You can view this through the following menu structure (Word, File, Info – and the Properties panel is on the right hand side).
Commentary
The document is 53 pages, 12,000+ words long, yet appears to have been edited for zero minutes, and never modified after it was created. Has this been copy-pasted from an external source?
While this may be highly exaggerated, there is a clear mis-match if we are expecting students to type the content of the document.
Look for shift in styles from previous pieces of coursework by the same student. Does the work match your expectations based on previous interactions with the student (grammar, technical insights, level and approach to reflection/evaluation, writing style, terminology use)?