The only way https://forums.alliedmods.net/showthread.php?t=233549
Only it shows in clients console which file is being uploaded.
The filename can be set to something like window.vmf and some junk text can be added to clients console before and after uploading to hide it.
Also late ban, on spawn for instance, can make the way it happens less obvious.
The file itself may contain original steamid in an obfuscated format to identifiy each user and connect it with sourcebans...