A TV license is required to watch broadcast television, so the number of channels they could be watching is finite. Even a muffled signal detected from a vibrating window (via laser microphone) could be compared to what is currently being broadcast by each of the channels (give or take a short processing delay) and any match found.
Nowadays it's mostly database enforcement. You obviously don't have to care about addresses that do have TV licenses so you just go looking for people with various TV subscriptions (Sky, Virgin Media) that don't have a TV license. It used to be done by the retailers submitting addresses of people who bought/rented TV equipment (TV, VCR, etc), any that didn't get (or already have) a TV license would get a visit shortly afterwards. Also people who watch programmes 'live' on-line (IP -> address conversion thanks to the DSL providers).
The local oscillator in the tuner emits some RF. This not only indicates that there's a TV receiver present, but indicates what channel is selected.
This was more of an issue with older tuners, because standards have tightened on emitting unwanted RF signals. Tube era tuners emitted a lot of RF, since the tubes themselves were out in the open, not behind shielding. Modern tuners are in small metal cans [1], which both shield them from nearby RF sources and prevent them from emitting. They also operate at much lower power levels than older tuners, so they don't emit much RF.
One of the unsung victories of regulation is that electromagnetic compatibility is quite good today. In the early days of consumer electronics, personal computers emitted so much junk RF that they'd interfere with TVs and crash other devices. A Radio Shack TRS-80 and a Milton Bradley Big Trak toy would both crash if nearby. Today, cell phones have four radios (cellular, WiFi, Bluetooth, and GPS) going at the same time without interference. When the FCC clamped down back in the 1980s, there was a lot of bitching, but the FCC was right. Now, it Just Works.
