They don't need that much granularity; it is enough to being able to point fingers at someone responsible.

But otherwise, it is possible to enumerate devices behind NAT (obviously, only those that communicate with the world in front of NAT) and assign traffic to them.