Is this pokemon legitimate?

GTS checks for hacked stats and abilities, not really anything else. There's no real wau to tell without dumping the .pkm file and running a legit checker on it. Even then, Pokemon that are hacked really well will slip pass.

What are you trading it for? GTS is filled with hacks, so most likely.

I'm not sure if you can catch a Megamium/Chikorita in the wild in Hoenn, though, so I'm pretty sure it's hacked.

I could be very well wrong as I don't play the games that much.