Time zone is just one indicator that doesn’t says much by itself. However if you have a handful of indicators, it becomes easier to positively identify bots.
Fraud detection for online shops works in a similar way, where they check your location, IP, delivery address and other metrics to assign a risk score to each order.
Maybe is in the metadata as someone pointed out earlier, or it could be an otherwise unused ASCII char that looks different for each user who licensed it when printed out, sort of like a qr code as a single ASCII char.
Or it could be that they simply just check filename, file size and/or md5, all of which can be easily changed.