i know this is an older post, but this just happened to me this week! i'm a heavy android user as well, using a Samsung i897 Captivate with a yummy gingerbread ROM on it. anywho, they send my a letter stating that the phone has been caught tethering! Please, i can do everything THROUGH the phone, i have little to no need to tether AT&T!
I too have a grandfathered UNLIMITED plan. this is highly annoying as i DONT tether! (i know how to... but dont have a need to.)
When i asked them what they classify as tethering, she was very limited on an answer. (i'm sure the rep actually had no idea.) BUT my average usage is 1-2GB a month, not back at ALL! but she claimed that my IP address changed too frequently... and thus it meant that another system was attaching to through my phone. first off, even if i WERE to tether, the tethering device wouldn't get an IP from at&t, but rather a local IP from MY PHONE... so o.k.; any other bright ideas AT&T?!?!
I too feel they are trying to determine a method of getting my off the UNLIMITED package. I told them to go to hell. I have a business with 5 lines on it, and this is the FIRST time in 4 years using their corporate service that anything like this has come our way. shame shame at&T shame shame.