In order to trace back the source you first need to figure out which device is generating the traffic. The best, in my opinion, would be to set up a flow collector of some sort. There are generally two ways to do this,
- Exporting flows from the device
- Software analysis to generate flows
Most high end network gear will generate some kind of flow record, such as sFlow, jFlow, or NetFlow. These are produced directly by the router and sent to a collector. You'll then use some kind of analysis tool like flow-tools or nfsen/nfdump to process the records.
Using other devices will involve getting a copy of all the traffic somehow, typically using a tap or setting up a mirror/span/monitor port on you border device. A tap is a physical device that you place inline with a connection and it will electrically duplicate the signals. The mirror port is configured on the network device itself and will send a copy of all packets from one switch port to another. Most "enterprise grade" devices support this, but for lower grade equipment a tap may be required.
Once you have a copy of the data you'll need something that will take the traffic stream and turn it into flow records. There are a number of commercial products, but I am most familiar with the open source product Argus, produced by Qosient. It will process the packets on an interface, much like tcpdump, and produce data files that consist of flow records.
Whether you go with exporting flows, commercial products, or Argus you now have everything you'll need for your analysis. Any of those collection tools will contain all the necessary tools to produce bandwidth reports like you want. Or just about any kind of report you want, really.
I'm sure this sounds like a massive overkill, but the results are fantastic. These types of records are invaluable for network troubleshooting, incident response, forensics, billing, etc.