Lumen is a tier 1 network so a lot of traffic passes through them. They can man-in-the-middle the traffic and see the TCP packets going through their network.
It's likely they just do sampling (think netflow) to get some statistics over the data that's already transiting their network.