It's not a matter of worrying about either/or. ISP's typically oversell bandwidth (it'd be near impossible to make a profit otherwise). It's not to their advantage to have a customer maxing out his or her connection 24x7. If a customer is maxing out their connection for extended periods of time it tell us the sysadmin that that customer either has a spyware/infected PC and is operating as part of a botnet or they're a P2P user. The ISP doesn't like either and will likely take action against both if they notice it's negatively impacting other users.