Thanks for those intelligent tips, mojomike.
I agree stats packages like analog may not be accurate, but multiple stats packages are all reporting < 4 Gig a day and the host is reporting 20 Gig a day!
Ya, I had looked into compression and delaying that path since all of our files are generated dynamically via a 404 catch, so I think we wont be able to utilize the caching benefit leading to performance issues.
Hot-linking (images and frames) seems possible, but these would still be logged by IIS and read by stats packages, right?
Databases are local, e-mail is minimal, but anyway the huge chunk in question is reported clearly as port 80, outgoing traffic by the host control panel.
The big file theory seems interesting. Took a quick look, but couldn't find anything. Would these escape the web server log file? Also, the host reports bandwidth granularly to a 5 minute interval and the high number is uniform throughout the day. So, it almost looks like there is some big TCP overhead or something like that not caught at the application (web server) logging level?
Everything else was working out at this host, but guess we will have to move hosts, once again, sigh ;)