The /me command adds \0001ACTION in front of the message and \0001 at the end, with \0001 referring to the character with the decimal value 1 (not the character that represents the number 1). It depends on your programming language how that character would be represented in your code.
So to detect a /me message you need to test if the message starts with \0001ACTION and so on, strip away the stuff you don’t want and then you got the original message. If you just want to ban someone for using /me messages then you don’t even have to do the last part.