Not with perfect accuracy, but the local oscillator of a receiver (which is mixed with the signal from the antenna to produce an intermediate frequency which is

Not with perfect accuracy, but the local oscillator of a receiver (which is mixed with the signal from the antenna to produce an intermediate frequency which is further processed) leaks back out the antenna a little bit. In the case of an FM radio, this means you can tell what station a given receiver is tuned to, if you make certain assumptions about common LO/IF frequencies. There was a company monetizing this called "Mobiltrak", but I haven't seen much about them lately. In the satellite case, there's the IF of the LNB itself, which leaks fairly loudly out the feedhorn, but it only tells you which band they're tuned to. There's likely a second IF used in the IRD, which should be much fainter from outside, but if you could recover that, you could tell which transponder is being demodulated. That still wouldn't tell you if the Toosheh packets are being saved, but if the program they're muxed with isn't particularly popular, it would be a strong hint.