Why? That doesn't seem unlikely to me at all - it's far easier to capture meta-data than content.

Given how phone networks work, that’s not entirely obvious. Perhaps they’re just retroactively taking a look at billing data?

Unless it was over WhatsApp.