Subpoena would more likely be for online threats, locating fugitives, charlie papa, DEA stuff.
DMCA violations are different requests that follow the same technical process but are taken more or less seriously depending on the ISP. If a subpoena is received saying "Email provider X says that a bomb threat was sent from IP A.B.C.D at 4:32 on the 13th of December", more or less. They typically already have subpoena'd some information from Google or Yahoo or Microsoft or somebody. Then the ISP goes back through DHCP/Router logs and reports back which subscriber that was. If CG-NAT is in use, the ISP will also require a TCP port or they can't respond to the request. I don't know anyone who would respond with a list of multiple subscribers. That would be useless for prosecution and real bad for the ISP.