Where, in the code, in the Satoshi client is 21 million cap implemented?
There are 3 places where GetBlockValue is called. One is on incoming blocks, one is on blocks we're mining, and one is an error message. This is the one for incoming blocks:

if (vtx[0].GetValueOut() &gt; GetBlockValue(pindex-&gt;nHeight, nFees))
    return state.DoS(100, error("ConnectBlock() : coinbase pays too much (actual=%"PRI64d" vs limit=%"PRI64d")", vtx[0].GetValueOut(), GetBlockValue(pindex-&gt;nHeight, nFees)));


Source

This looks at the first transaction (the coinbase transaction) and checks the value. If it is larger than the subsidy plus the fees, then the block is rejected and the node that sent the block is blacklisted.