It's logical to think that they are somewhat preferentially targeting the high data users since the cost-benefit ratio increases as they go after people that use less data (they have to pay people to actually do this, however it is done.) I have tethered via TetherMe very sparingly, probably only used it a handful of times in the last 6 months. My usage is between 200 MB and 300 MB every month. For someone like me, I'm not at all convinced it's worth their time to go back into my usage history and look for a few MB of transferred data via tethering once every couple of months.
Per your point, in my previous posts, I've also suggested that AT&T is auditing their highest data-consuming users first, then working down the chain. But in the end, I still suspect that AT&T will eventually get around to auditing all accounts for abuse, to enforce their policy of non-authorized tethering across their entire network.