It is impossible to guarantee that GTS Pokemon aren't hacked, but it is very unlikely that this Vulpix is hacked. I own many Pokemon that are like this, and their origin story is actually pretty simple.
This Vulpix would be what the breeding community calls a breedject, which is a blending of the words 'breed' and 'reject'. (You can verifying this by putting it through the stat judge, and checking for deficiencies in its IVs.) The term is a bit cruel: but basically, the person you traded with would have been attempting to get a 6 IV Vulpix through breeding. They would have hatched the Pokemon you have, and seen it is missing a valuable IV somewhere: so they would set it aside, as it is not what they are seeking.
Once breeders finally get their 6 IV prize, they'll usually have at least a dozen 'breedjects' left over in the PC. Obviously, these Pokemon aren't very useful to them anymore, and most of the time they're simply released to free box space. However, there's a more economical (if annoyingly time-consuming) solution, which is to put some of them on the GTS for a Pokemon of their choosing in return. Usually they will request a Pokemon that enables an egg move they want, or can act as a parent in their next breeding project.
For avid breeders with a good breeding Ditto, accessing 6 IV, competitively-fit Pokemon is almost too trivial: so Pokemon like this that look fantastic (but are just slightly deficient) aren't so hard to come by. You can often spot breedjects on the GTS if they have a somewhat fitting Pokeball, like your Vulpix does: so if you get smart with it, you can find some pretty amazing things. I once traded for a 4 IV, HA Lure Ball Totodile with Dragon Dance on the GTS, which I then bred myself and ended up with a 6 IV Feraligatr.
One thing to be aware of is that the person you got the Vulpix from was likely using a hacked or cloned 6 IV Ditto to breed. Despite this though, the offspring it makes is 100% clean, and tournament-legal. There is still the possibility your Vulpix is hacked as well, and I'd have greater suspicions if it turned out to be 6 IV itself -- but the breedject economy is too large, and makes too much sense for that to be a plausible answer.