Generally CnD letters are not generated by the ISPs themselves. ISPs don’t care what you do unless legally obligated to. When you get a CnD letter, it’s usually because someone working for a copyright holder was on a torrent and snagged your IP, then sent an infringement notice to your ISP, who in turn sends a CnD to the current holder of the IP, i.e. you.
At no point does your ISP have to read your digital communications themselves. Any one of your peers on a torrent can tell what your public IP address is, it’s inherent to the BitTorrent protocol. Copyright holders take advantage of this to catch pirates.