I think AT&T just logged the IMEI of the phone that used their towers, which I believe is sent as a standard part of the authentication packets the phone sends to the towers.