As the target of an ongoing magic spell (note that Magic Jar's target is "one creature", not the caster, nor the receptacle used) a possessed subject would be giving off a moderate magical aura to someone using Detect Magic to survey subjects. Of course, you have to follow that up with a DC20 Spellcraft check to identify it's a necromantic aura, and even then that doesn't tell you what the spell is; but someone wandering around with an aura of necromancy on them would be suspect.
As you've mentioned, the infiltrator needs to be able to convincingly pretend to be the possessed subject for this to work, so will be making bluff against sense motive checks and could conceivably give themselves away by saying the wrong thing to someone familiar with the subject. More strictly, if this is a high security area that's being infiltrated and security is worried about people in disguise, there may be a password system in use to verify identity; the infiltrator might not know the password, or know an old password, or could even have been given an incorrect password that's actually a secret warning to the guards.
Zone of Truth is a low-level cleric/paladin spell which might be used to interrogate people entering a high security area to make sure all is as it seems. However, passing the will save on that would probably not be very hard for anyone who has the ability to cast Magic Jar.
Protection from Evil is another low-level spell which could expose possession by Magic Jar, assuming your bad guy is capital E Evil. If the subject is affected by Protection from Evil, they would get to make an immediate second saving throw (with a +2 bonus) against the effect. If successful, the possessor is not expelled, but does temporarily lose control of the subject:
This spell does not expel a controlling life force (such as a ghost or spellcaster using magic jar), but it does prevent them from controlling the target.
It seems to be your discretion whether that means the original subject actually gets control of their body back for the few minutes the spell lasts, or the subject just does nothing because nobody's at the wheel now.