That would require a lot more than editing memory offsets though.

No they just read the memory. The whole point of an external cheat is to only read memory. They can still use Win32 to send inputs.

How do you determine whether the mouse is over an enemy head? Is there some variable the engine maintains for that?

For Counter-Strike 1.6, source and GO your crosshair would change and indicate that you are aiming at a player. Not sure about CS2, but wouldn't rule it out either.

It's a bit slow, but you could grab the player ID, then check if the player is on your team or not and then fire. Either by sending a mouse input, or if I remember correctly by writing to a specific address.

However, with enough knowledge (which is mostly documented online) you could actually pull out the hitbox, skeleton and animation data and just run the line-box intersection step yourself. Easier to do internally by hooking in-game functions though.

There is a list of entities in memory, models have "bones" for animation purposes, knowing the address of entity in memory you can find out if it's an enemy player (compare team ids), where the head bone origin is, and you also can read the view angles of your own player to see where you're looking. The tricky part would be doing a ray cast to see that you can actually hit the enemy and not shoot a wall - internal cheats can just call builtin game functions, externals can't.

No experience, but I think the game seems to track it? The default crosshair seems to change depending on what you're aiming at.

Read the player position and camera from memory, read enemies positions from memory, use basic maths to detect if camera is pointing at an enemy.

or the game engine could track internally what the player is looking at (GTA does this).

In Source Engine games, your inputs are stored in a struct ("usercmd", if I remember correctly) before being sent to the server in a client tick. You can modify that struct, a mouse click there is a bit flip on one of the fields. Rotation and movements are float fields. Modifying that struct makes your client send the "inputs" without a need to actually "call" anything.