I got one of these mails when my vpn dropped for something like 6 seconds (they even send your the timestamps). I wouldn't be surprised if they are seeding their own copyrighted work to figure out who's uploading. Once they get the IPs they simply have to ask the ISP for the name/address of the IP owner at that time.
Anyway, however they are doing it they seem to be very good at it.
900 reduced to 400 after I mailed them. I only paid because I was in a foreign country and didn't want to take any risk. Apparently they'd take any amount because going further in the process end up costing more to them (and potentially much more for you too).
Also, in the meantime it was pretty well established that they can't hold you responsible for the actions of others.
"I'm sharing WiFi access with several neighbors. In accordance with privacy laws, I don't retain any router logs because they're not necessary for this. I've reminded them again not to do illegal shit, as I've already done when I set this up. My router does not provide support for filtering traffic, and it would be unreasonable for me to go buy a different one just because of this. Kthxbye."
Anyway, however they are doing it they seem to be very good at it.