Perhaps they scanned the ships and detected an artificial lifeform on the bridge and deduced that he transferred over to command. It's been established that sensors can detect different kinds of lifeforms (including artificial).
Although I don't know how accurate Romulan scanning equipment performs once cloaked, how would the sensors tell the Romulan ship that the artificial lifeform is the captain?
Actually,
Marsden's reference to "Balance of Terror" (don't be shy

) made me wonder about a couple of things that could put some issues into a completely different perspective (irony on):
Now, Stiles suggestion occurs
before they see Romulans for the very first time. Certainly, it puts Spock in an uncomfortable position, but instead of acting like Data aboard the Sutherland in "Redemption II", Spock starts to act out of character, shows insecure behaviour and is neither cool or logical.
Actually not a big surprise considering the Romulan Commander looks like his father and could be some kind of twin. It's unlikely this is his father's Vulcan twin brother working undercover for the Federation, but could it be his father is actually a Romulan which would make Spock not half-Vulcan but half-Romulan instead?
It almost looks as if Kirk knows that's something is rotten on the Planet Vulcan, as he most efficiently provokes Spock in "This Side of Paradise":
KIRK: An ambassador from a planet of traitors. A Vulcan never lived who had an ounce of integrity. You're a traitor from a race of traitors. Disloyal to the core, rotten like the rest of your subhuman race. (Does Kirk know more han he is willing to admit in public?)
Then the strange circumstances of the death of the Tellarite ambassador in "Journey to Babel" at a moment where Sarek didn't have an alibi. Kirk asks explicitly who aboard could perform such a kind of execution:
KIRK: Who aboard would have that knowledge?
SPOCK: Vulcans. On Vulcan, the method is called tal-shaya. It was considered a merciful form of execution in ancient times.
There are over 100 delegates from other Federation (!) planets aboard, but none of them is possibly a suspect, yet an Orion somehow learned what must be secret knowledge of ancient Vulcan executing form. Hear, hear!
Then there was "The Enterprise Incident". Was the Romulan Commander really that naive or did she just miss her opportunity to tell Spock about his true Romulan half to win him over?
Fast forward to TNG: On Stardate 44390.1 the Enterprise-D receives Vulcan Ambassador T'Pel ("Data's Day") who turns out to be actually the Romulan Sub-Commander Selok, an imposter. Did nobody ever check her credentials? How could she attain that status on Vulcan? Don't the Vulcans share personnel files with other Federation members or Starfleet? How is any of that remotely possible?
On Stardate 44769.2 Starfleet has apparently reacted to the aforementioned incident and put Admiral Norah Satie in charge as a special investigator (about darn time, I'd say). Can we really blame her for being overcautious when Romulan sabotage might be involved? Unfortunately in "The Drumhead" things go south at the expense of Admiral Satie who was probably sent back into retirement (the whole affair was probably a Romulan ploy to get rid of her to start with).
Next the Romulans kidnapped and brainwashed a member of the Enterprise-D ("The Mind's Eye") and we finally learned that Sela had secret information about Data being put in command of the
Sutherland (
Dr. Selar, anyone?) And a couple of weeks later Ambassador Spock vanishes without a trace and it is only by chance the Federation learns he had left for Romulus.
Well, in "Amok Time" he claimed he had to return to Vulcan, take his wife or die. He returned to Vulcan, didn't take his wife but lived. Maybe in "Unification" Pon Farr took Spock to the planet he should really call home...
Could be an issue worthy of further examination - or not (irony off)
Bob
