I work in IT and had to explain this to my dad after he got the same letter. ISP doesn't know what you're watching specifically - they know the IP addresses your traffic went to and cross-reference with known piracy sources. VPN routes traffic through a different IP so the ISP just sees encrypted traffic to a VPN server. That's it. It's genuinely not complicated