It may be very simple and i am just really wrong with this, but here are my thoughts.
Few days i ago i was testing some commands and I made output for every command
client_command() forward catches. When I press number 3 for instance, it catches
weapon_knife command. So they *maybe* put some weapons in those slots with different weapon data so they can hook it like this.
As i said, I may be wrong, but this is a possible way I can see.
EDIT:
You could also display an empty menu with keys bitsum you want to detect, so I believe you could catch all numbers(0-9). Only problem here is when they open different menu. Maybe activate that invisible menu if they have no other menu open(there is a offset for this called m_iMenu i think) in PreThink(maybe a bad method, but that is first thing on my mind right now).