Basically small deliberate changes to the brightness or hue of chunks or even individual pixels scattered across the frame. Netflix would have the original, and would know where to look for the changes that embed the user ID data, or whatever.
They just get a copy of the leaked video, locate the ID, and take the user to court or ban them.
I’m not great at explaining it, so look up image stenography to get an idea of what I mean.
Anyway, I don’t have any proof they do that, but I guess I always assumed they did, because… why not?