It is always possible that two students pick exactly the same wrong answers by chance. In other words, if a completely water tight proof is needed, then proving academic dishonesting with an online exam is pointless. In a system where “proven beyond any reasonable doubt” is sufficient, there is hope (to prove academic dishonesty).
One technique is to compare the least likely case (the one that is likely to be the result of copying) to the next least likely one. If the least likely is 0.01 of the second least likely, then it should make a very strong case.
Once the probabilities are sorted, if two adjacent probabilities differ by 
(or the natural logarithm values are off by 1.6),
it can be conservatively accounted by chance if each multiple choice question has five choices. This is not even taking into
account that students do not pick answers by chance, and that most students probably pick just one or two popular wrong
answers.
A “normal” class of a reasonable size should have clusters of probabilities where each probability always has another one
that is within 
of itself. This is especially the case if a class is pre-partitioned into groups by score. Any probability that is
from the next smallest probability deserves some attention.