I obviously don't know how they're actually doing it, but you can perform all kinds of analysis on traffic even when it's encrypted. You can look at the distribution of packet size, the time distribution of packets, you can analyze who is sending packets to whom. Traffic analysis like this has been a field of study since at least World War I. [0]

If you want to find Telegram traffic, you're probably looking at fairly small packets, often sent in bursts. If you're observing the sender and the receiver, you might be able to correlate the the outgoing messages from one user with the corresponding incoming messages of another user.

Of course, there are corresponding countermeasures Telegram could take: pad messages, combine messages, split messages, introduce random delays, distribute messages among a number of different endpoints. It's an endless game of cat and mouse.

[0] https://en.wikipedia.org/wiki/Traffic_analysis

DPI = Deep Packet Inspection (it's in the article)

DIAF = die in a fire

In this context, DPI is deep packet inspection.