This type of situation is extremely dangerous, especially if the users are downloading illegal content like pirated movies. Streaming video is another big bandwith hog. You'll likely need a traffic analyser such as Internet Security and Acceleration (ISA) which comes with Small Business Server.

Alternately, implement TCPIP Filtering in Routing and Remote Access (properties of the internet interface), to deny all traffic in and out except Port 80, 1723, 25, 110, and 3389... 80 is internet website traffic. Most downloading apps, ftp, and other hogs use special ports outside those.

Now,if your server is not acting as a router to share the internet to the lan users, than this task is completely required to be handled by the router/firewall device, which few actually support this kind of thing.  Another thing you can try if this is the case is hire a consultant to run network monitoring, and then pay him some bucks to analyze the findings.  To make this work, they have to know what to look for... they'd be looking at raw data, in the form of many packets with various headers and content. Tracing the system that sent/received the packets is the easy part if you find the right packets.

:-1