Just periodically run a log scanner for requests for SWFs, etc. Lots of simple non-constant log scans will reveal this information.
Good luck suing them. They offer tethering for a price, you're not paying it. I think the chance you'll get away with invasion of privacy on something that they technically should only see from flagged account is about 0.