2) They do deep packet inspection and simply pull the user agent out of HTTP traffic. They block certain desktop browser user agent strings if those user agents transfer a certain amount of data. If you set a browser on your phone to use the Chrome, Firefox, or IE 10 desktop user agent string for windows, it will trigger this too, even if you've never tethered in your life. Try it with the iPad user agent string. Triggers it too after awhile. Only HTTP traffic is blocked. They don't even try to intercept HTTPS, or seemingly any other protocol for that matter.
...
4) Using a user agent switcher, like the "Ultimate User Agent Switcher" for Chrome will get around this. I use the linux firefox desktop string and it works 100% so far. On a broader note, it's good to see they're moving towards a more honest business model with the new plans (why does it matter how you use your xx GB? To any rational person it's like the electric company charging you one rate for power but installing cameras in your house and forcing you to pay extra if you use the power for your microwave... but I digress...) but in the meantime while the industry or government regulation (not holding my breath) catches up with common sense, this is the solution.