They appear as torrent peers I think and log when they get a connection to share parts of the file to their system. I assume then they look up the IP and they try to find out if they got an IP from a known VPN provider or a private one. And then they send out the papers.
Note: In the paper it only says that they have evidence that my PC shared parts of that file 3 times in quick succession and that’s it, the rest is my deduction / educated guess.