Typically it’s accomplished by checking IPs, domain registration, or tying other identifiable accounts to the posts. By language use, personal references etc. Then basically corroborating by trailing through publicly available information about suspected sources, social media activity and the like.
The other angle is targeting known people involved with publication. Leaks from that direction or things like private communications often reveal they know who it is.
It’s complicated with Q because of how 4chan works, there are no logins. So posts are not neccisarily tied to a particular poster or series of posts. As the Q identity was simply signed at the end of posts, pretty much anyone could do so. And so long as they mimicked the style well enough it would pass. Because of that it’s a lot more complicated
The going theory is there were many people posting as Q, with “real” Q determined more by which posts were accepted than any connections to a particular poster. There were a lot of “fake” Qs, numerous claimants and other “leakers” claiming to corroborate that have been identified. But it’s entirely possible that the original Q never made more than one post or was part of a coordinated group troll that took off.
Once everything moved to 8chan a main Q took to identifying themselves with a particular, difficult to fake tag. Which makes it more feasible to tie the series of posts to something else. Current thinking seems to be that the 8chan founders themselves are either Q or know and coordinate with Q directly. And the 8chan Q has been tied to most of the most influential Q posts in various ways. Though not neccisarily the earliest ones.
It’s likely that if we did identify exactly who current Q is, some other subset of Q posts would suddenly become “real” Q.
There are all sorts of unidentified, anonymous sources like this in conspiracy. Because at base it’s as simple as sending a letter or dropping a line to a particularly active or prominent member of the scene. If it garners their interest, and they put it out and generate popularity. Others will pick it up and expand on it, even if you never involve yourself or give it another thought. Often enough it’s that initial contact that does so to satisfy demands for more information and keep the positive attention they themselves get going.
Q is just a faster, messier, internet bound version of that.