Server 2003, SP2.

I have activated my license server (User CALs) and marked it as having 10 licenses (registered via Internet), since I was told we would be buying 10 licenses. Instead, the company only bought 4 licenses for that authorization/license number, which I just found out. So does that mean Microsoft is going to come knocking at my door now, since we've been USING the 10 licenses? Or do they not keep track of that (I've read they don't monitor User CALs--what does that mean?)?

No, Microsoft doesn't have a record of the number of licenses you install on your server (neither Per Device nor Per User licenses).
Theoretically, they can perform a licensing audit, i.e. visit you and demand to see how many licenses you have used and how many you have bought. This is a normal procedure for bigger companies (my company gets audited every third year or so, we have >12000 clients), but for a company of your size, the risk isn't to high.

Still, you have to stay within the EULA, which means that you cannot allow more users to connect to your TS as you have licenses.

Per User licenses are not managed, which means that they are not really issued. The easiest way for you to make sure that you stay compliant with the EULA is to limit the number of users which are part of the Remote Desktop users group on the TS. In your case, with 4 TS CALs, you can have a maximum of 4 normal users there, assuming that you as Administrator always connect to the console of the server to avoid using a license.