Verizon had installed spyware onto Droid X's that would monitor if the device was tethering or not and would check against the account to see if they had a tethering plan. Sprint/HTC installed CIQ onto a few of their handsets which seems to monitor a number of things, including tether usage.
A lot of the current strategies seem to revolve around putting the monitoring software on the device, itself, rather than look for it server side. I'd be willing to bet because Google doesn't distinguish tethering as something other than generic data use.
But I would imagine that ALP makes a very good point. If you started looking for windows update from your Android phone or anti-virus definitions, that would look suspicious. But you don't connect your windows laptop? I bet they would also be a little suspicious if your browser user agent said "iPad_2", "Android_Tablet", or a generic Linux user agent and you were pulling some pretty big webpages through your browser. Or connected to the Apple App Store through an Android device. Even the Android Market for tablets is slightly different.
Food for thought.