Just got an s5 active to complament the Rugby Pro (SGH-i547) I've been using for the last year and a half. Since both devices are part of the same ecosystem, I beileve some of the stuff I've done on the Rugby Pro should work (or at least lead to a viable solution).
orginal source: (http://forum.xda-developers.com/show...&postcount=335
In a nutshell, the framework-res.apk has a few lines of xml refrencing the tetherprovisioning (under the decompolied framework-res.apk hierarchy res/values/arrays.xml)
<array name="config_mobile_hotspot_provision_app" />
It is pluasible to beileve that the S5 (and releated varients) also use this as a means (as a network based boolean check) to determine if the account has tethering enabled. If I recall correctly, AT&T routes the tethered data through different APNs then mobile data, text and voice, therefore causing the cease and desist letters to be sent.