I've read that some implementations of NAT would allow the ISP to estimate the number of hosts behind the NAT by examining tcp sequence numbers. OpenBSD is paranoid about this too and tries to eliminate tcp sequence patterns in their NAT.