What they could do it look at the target device. If a device have use X Mbit/s over the last Y seconds sustained, then just start throttling it until the sustained traffic stop and then un-throttle. In that case they don't need to look at the actual traffic, just how much you're generating. That would also hit all services equally.