How does your phone know that another phone has iMessage? Is it set up manually by the user or do phones lookup the phone number on Apple's servers? If the latter then would it be possible to reverse engineer this to test if any number was an iOS device?
Your phone number is associated with your Apple ID. So I'm guessing they just reverse lookup the number you're texting to determine if iMessage can be used. It can definitely be reserved engineered. Just text any number from an iOS device and see if it switches to iMessage. The only caveat is users can remove their phone number association with iMessage so you could never be 100% sure.
