Forum Moderators: phranque
Then check all the files in your web directories. Are there any new files, particularly large ones, that have recently showed up? Did you added these files or did one of your co-webmasters add them?
About four of months ago, a Star Wars RPG site for which I am a co-webmaster of saw a huge spike in bandwidth usage, roughly 600% half way through the month. After some digging around, I found that an archival image of Galaxy M100 (1200 x 1200 and 282 KB) that we kept was getting a lot of hits recently. Then I checked our top referrals and saw that a space simulation site was using that image as the background for one of their pages.
After the discovery we took down the original images and replaced it with a white on black image that read "F#@$ You <website name>! You Bandwidth Thieves!" Soon after, we stopped receiving any further referrals form their site. Unfortunately, we can't block hotlinking using mod_rewrite because it screws up with the FrontPage extensions on the server that allows most of the co-webmasters access to their respective (sub-)web(s).