They know which IP address belongs to which customer at the time and anybody can download a torrent of some copyrighted content and see which IP addresses are down or uploading it at any given moment. No need to inspect RAM, no need for DO to monitor traffic. They (the copyright holders) will send a cease and desist through DO already, and could change to send a lawsuit instead.