Find which machine is using all the bandwidth
We use MRTG (free) http://oss.oetiker.ch/mrtg/ to monitor traffic on our routers and switches. This will only work if you are using managed switches that support SNMP.
What about the old email to staff@?
"I just bought a monitoring tool that will tell me who's using up the bandwidth. Here's a link to the paragraph in the employee handbook that explains the policy on internet use. I will be installing it tomorrow. You've been warned. Thanks."
Might work, and if not, you've got some suggestions from the nice people here for actually following through on the threat.