How do Open Source projects audit code to ensure it comes from ethical sources. For example, if a hacker hacks into IBM, steals some code and contributes it to the kernel, how does the kernel team ensure that it doesn't get into the kernel?
The short answer is
they don't OK, most of them don't.
The longer answer is this:
When accepting contributions, many projects have contributor agreements. These often contain a clause that says "if you submit code, you certify that you have the right to license such code to the project". If someone's committing stolen code, they don't have the right to license it, so their contribution is legally void. If IBM comes after the project maintainers for including that code, they can simply point to the agreement contract and say "blame him".
Even for projects without a contributor agreement, there is the principle of good faith. A project accepts contributions in good faith; that is, they assume you have the right to license them the code you contribute. If you don't, the project can't be held liable because of this - they would have to replace the offending code, but they wouldn't be legally responsible for damages, etc.