ii) the exchange is not sending its change back to another address in its wallet "cluster", which is particularly the case for hot wallets since custom exchange software does not use standard wallet types with HD derived address/privkeys, and
HD addresses doesn't matter, they look the same as any other address and it is impossible to determine if they're with the same HD seeds.
Some exchanges don't publicly reveal their hot wallet addresses anymore or just use several unique ones. Tracing the path of your deposit or the inputs to your withdrawal should be sufficient to check if it likely belongs to an exchange or not.
iii) all Wallet Explorer can do is group different addresses together, it cannot use external information to ID an exchange based on a particular cluster of wallet addresses.
Wallet explorer usually have a set of addresses that are known to belong to the services and determine the link through associating it with the cluster of addresses. If a known address is within that cluster, it'll probably associate the cluster with that service.
From my experience, it was able to positively identify quite a few services though and the success rate was pretty high as well.