1000Base-T uses four pairs in both directions at the same time. It does this through the use of a hybrid in the PHY that subtracts what is being transmitted from what is received on the wires. 802.3ab is a fairly complicated specification with many layers of abstraction. I spent a few months studying it for a project about a decade ago.