We are running a BM 3.5 server behind an ADSL router with NAPT enabled

over the weekend our ISP reported 1.6GB of downstream traffic and yet
one was here the BM logs reflect very little activity (6mb downloads.

Where do I look to find more info as we pay per MB.
Stressed out admin!