Who's consuming the most network bandwitdth?

If you have a large number of users (say 20+), and this is becoming a real problem, it might be time to implement an HTTP proxy that all web traffic must pass through to get out.

This would also mean that you can assign users credentials that they must enter in order to get out to the internet, which saves you the issue of having to translate a monitored IP address that is using heaps of traffic back to a computer and therefore a person.

If you are looking for a free solution, this could be something like Squid on a DD-WRT router, or if you want to put some $$ in you could get Microsoft FTMG Server or the likes of WebMarshall.

Obviously this would require that you can stop web traffic getting out directly through the router - except if it comes from the proxy server.

Good luck!