If you dig into the code you'll see that it's actually just very very fast, and not truely instant, which would make it hitscan. In the true sense of the word, hitscan determines if it's a hit at the firing time, and not on the server. The client just sends the "I'd hit it" message to the server and the server verifies that it's not a spurious command (very light cheat protection) and then takes the damage. This makes auto aim very possible, because you just need to send the message every time you're able to fire and your cross hairs touch the enemy. T1 has no true hitscan weapons, and (ZOD or somebody will correct me here if I'm wrong) I don't believe that T2 has any true hitscan weapons either.