RCI has stated vociferously that they will crack down on any agent who does this. All cruise line payments must be paid in full and if an agency cuts a rebate check and they find out about it they will be "de-listed"
But I am wondering the same thing as you are. How are they really going to know? As long as the cruise line receives full payment, they can't know what the agent does.
I am not a travel agent - and I doubt that any are going to come in here and tell us how it will be done, bit I am sure a small travel agent could easily start a separate checking account or pay an instant rebate in cash. There are probably a dozen ways.