The ISP is looking for IP addresses in its address range in the peer list, looking it up in its customer database, and sending its own customers a letter.
As I explained in another post, I used to work at a small ISP many years ago. We did not monitor anything, but we did get emails from MPAA people (my memory is a little fuzzy) about an IP downloading a something. We would then pass it on to our customer.
No clue how MPAA letters interfaced with them. Could have been an agreement with them for all I know.