And customers never broke the Terms of Services, right?(I too know how to include the rolleyes in my post).
These customers very well may not have.
At the end of the day, AT&T is not being transparent. They don't tell you when the incident occurred, how much data was used, what triggered the alert, etc. It is very possible that there are more false positives, but without knowing how they're determining it, it's difficult to prove that you didn't tether. Also consider fact that all of our TOS' restrict our ability to take legal action against AT&T. They can basically do whatever they want without worrying about anything.
What I do know is that there isn't a single detection mechanism for anything on this planet that doesn't generate some false positives and false negatives. AT&T may very well have done their due diligence to minimize that risk, but with a customer base of around 100 million, there are almost certainly some folks getting false alerts.