They won't be able to run a custom warden module without a modified client. The warden module contains a signature which is being checked by the client, this signature was signed with the private key on Blizzard's side.
Unless they have cracked the Key, which is highly unlikely, they won't be able to write their own warden modules.
You are correct about them being able to check which processes are running, I assume that Wrobot is circumventing this scan of course, otherwise it would have been detected ages ago.
Looking at all the evidence it is quite clear that they have a way to establish a link between all accounts.
I don't believe that they are using a modified warden module to fingerprint the computer the client is running on, in fact this is quite easily verifiable by hashing their warden module and comparing it to known modules (as far as I know there are only 2 known modules for the 1.12.1 patch - could be wrong though)
As an educated guess I would say that they do one of the following things to fingerprint users (some of which have been mentioned by others as well):
Monitor accounts with certain mail providers
Browser canvas fingerprinting (highly likely)
IP address lookup's to verify that the IP is not from a blacklisted proxy provider (this is one of the most likely methods as well)
They've further reverse engineered the client or warden and found a way to fingerprint an individual computer (scariest possibility as there wouldn't be any quick bypass)
Wrobot hasn't bypassed all warden scans and warden is still able to scan for processes running (verifiable on the user side)
Could be either one of those or all together, who knows. So far I haven't been banned on any of my accounts (I'm running more than 4), therefor it's hard for me to look further into it. Almost wishing I'd get banned so I could tinkle around (hope I didn't jinx myself here)