We are running a BM 3.5 server behind an ADSL router with NAPT enabled

over the weekend our ISP reported 1.6GB of downstream traffic and yet
no-
one was here the BM logs reflect very little activity (6mb downloads.

Where do I look to find more info as we pay per MB.
Thanks
Stressed out admin!