We've got pretty rudimentary tools at my job, but we can still see source and destination address (even through a NAT and proxy on our end), IP ports/protocol, time of day and speed of connection trends, and we can do small amounts of packet inspection (we grab the first 120 bytes of every packet).
With this data, I'm able to tell if someone is using BitTorrent vs Skype (they're both peer-to-peer UDP packets to random addresses, so finding the difference is key). I can tell where their information is being sent to. If the packet is not encrypted, I can see exactly what is being sent (the header data will show filenames being transferred). DNS data will tell me what site they've just visited, and packet capture will tell me what specific page they're on and what search terms they used on that site.) With an unencrypted session, it's as easy as piecing the domain name from DNS (thepiratebay.com) to the packet capture (http: 11:23pm March 15, "the office", /search/test/0/99/0) to the user (10.250.250.10) to the network flows (every few seconds there's another couple packets going out to or coming from a few dozen address across the world). Bam, we've got an infringing user.
Now granted, people will likely be using encryption. I don't know how the tools handle this, we don't do anything with it at my job. However, I would imagine the ISPs could do deeper packet inspection. I would imagine they simply don't care if your traffic is legal or not. They may assume it's all illegal and serve notice anyway. There may be an appeals process. As for the difference between Hulu and joe-streams-hollywood.com, I would imagine they have a whitelist of addresses.
TL;DR; I don't know, but I can make an educated guess. Best bet, encrypt your traffic but don't rely on that to save your ass.