I think live video has a bit different pattern than video on demand.
But aside from it, it should be very obvious: A) you are notified by the intellectual property holders that somebody is streaming pirated content, B) a specific customer or set of customers, who are not a known streaming service, are serving tens or hundrends of IPs with video and C) these customers do not have much activity during other times.
These are not peer to peer connections. These people would send a single stream to twitch and then twitch, a known streaming service, would stream it to their viewers.
In theory someone might rent a server and do the streaming directly to his viewers, without using a known platform. This would be a legitimate false positive as you describe. But this would be so expensive I doubt anyone would do it when the alternative is a free platform with built in community and monetisation tools.
But aside from it, it should be very obvious: A) you are notified by the intellectual property holders that somebody is streaming pirated content, B) a specific customer or set of customers, who are not a known streaming service, are serving tens or hundrends of IPs with video and C) these customers do not have much activity during other times.