The speed cheat works by the client lying to the server about how much time has passed since the last packet sent. Therefore, the cheat detection is simple. For a period of say, 30 seconds, QuakeForge adds up the times from all the movement packets received from a specific client. If the client says that more then 30 seconds passed in 30 seconds, a red flag is raised.
Sadly the Windows QuakeWorld clients before 2.33 had a bug in keeping track of time. The longer Windows is up, the faster time will seem to pass. While there is not a noticeable speed boost from this until it has been up for more then a day or so, it is detectable even after the system has been up only a few hours.
This and several other factors can cause the time reported by the client to be over the time the server expects. Lag and packet loss are some of these factors.
sv_timekick: This cvar controls the number of times a player has to be caught "cheating" before they get kicked. sv_timekick shows up in serverinfo if it is changed from the default. If sv_timekick is less than 1, speed cheat detection is disabled. Default is 3.
sv_timekick_fuzz: This cvar affects how strict the protection is. The higher the number, the more "fuzz" is applied, and the less strict the detection code is. Raise this if your players are being kicked for packet loss and lag. Default is 10, giving a fuzz factor of about 1 percent.
sv_timekick_interval: This cvar controls how often, in seconds, the time tally is counted. Lowering this value increases the chance of false positives, but helps to minimize the amount of damage a speedcheating player can cause. Default is 30 seconds.