I was just thinking about two things at once: 1) I hate the typical method where spies, when caught, result in automatic immediate DoW. Seems excessive as spies (doing very bad things like poisoning) are caught from time to time in the real world and never result in immediate war declaration. 2) I don't think it should be easy, but there should be some possibility (even for non-Emperyan and even for the AI) to distinguish uncorrupted Bannor (following Order) from corrupted Bannor (following Order and CoE).
So putting the two thoughts together: what if spy discovery resulted in "Esus follower revealed" and a diplomatic penalty. The diplo penalty might be the normal "follows-other-religion" penalty plus penalty (if any) that would be given for being evil (so no sweat if Tebryn finds out you are CoE, but very problematic for those "good" allies).
I haven't played the mod you've probably experienced this in, but I have played a lot of standard Beyond the Sword. In BTS, when a spy is discovered, there's a chance that the nationality is uncovered as well. Most of the time it just says a spy was caught (and there's no diplomatic penalty or war). There's a....maybe 20% or so chance that the spy's nationality is identified - in which case it's just like you're describing - a diplomatic penalty of -1 for each incident in which your spy was caught AND identified. Your spy was caught making trouble or something like that. That's actually the design I was picturing, and not a triggered war based on that incident alone.