If I was AT&T looking for unauthorized tethering folk, I'd focus on the people that are using > 2 GB a month + other various heuristics. Something deff smells funny if someone is using substantial bandwidth and much of the traffic is with a UserAgent like Firefox or Chrome