How to know if Ho-oh or any other legend is legitimate?

The only way to figure out is through a legitimacy checker, which can be found on the internet, but usually involves cheating to access the coding to find out.

But, for the Time and Space part, all that means is that the Pokemon was from a previous game. Probably from Heart Gold or Soul Silver via means of Poke Transfer and Poke Bank.

As long as it does not have illegal stats, abilities, types, or moves, you can use it in online competition.

EDIT: Pokemon that have traveled across space and time can be used in non-ranked online battles, but to be used on the ranked side of the battles, they need to have been caught/bred in the 6th generation games.

If it travelled through Pokémon Bank (ie. came from Johto in this case) then it has already been through Nintendo's hack checks. With that in mind, it's either legit or good enough of a hack to not be detected.

That said, one of my friends has a Bug Bite Scizor with a Kalos-native symbol on its Summary, and another friend is probably personally responsible for the delay in Bank's release due to pointing out some major flaws in the hack checking system!

Anyway, point is, just because it's shiny and has high IVs does not mean it's hacked - it just means the person who obtained it has no life :p Okay, that was mean...