When reviewing code one of the ways to quickly spot "messy" logic is to look for module-scoped variables with whacky names. Poor naming is often an indicator that the reason for writing code was unclear to the developer at the time.
Let's get an example eh?...
bool _flagWhichGetsSetOnReturn = false ;
That's a pretty whacky name right? Once I've identified a prospective refactoring candidate I'll do a "Find" operation to see where and how it is used.
Most times, after a quick scan through you have an epiphany moment when you suddenly understand what it was that the developer was trying to do at the time.