It could be different command, for example "getfullwork" that can be used instead of "getwork" so it would not be neccessary to get full blocks all the time (for example random 5% of getworks would be getfullworks), but the possibility of such verification would make it impossible to cheat for the pool.
The pool owner could return a block with a pool address when getfullwork was called and a private address when getwork was called, you'd be none the wiser. You'd have to call getwork then be able to pass that block header back to the server and request the full block that matches it.
