[jimbobimbo]

Unless they're performing a deep packet inspection, there's no good way to tell if you're tethering. Usually tethering option uses user name that differs from non-tethered option during authentication. If your unathorized tethering application sits on the device, it simply shares non-tethered connection, hence the user name doesn't change. The only plausible explanation w/o going deep into packets - bandwidth or some unusual ports usage.