hello omq,

I am just one of the "occasional" users of the forum here, right now checking for replies to any of my prior postings (a month ago) and checking to see what's new, thus I spotted your enquiry.

If your bandwidth is getting close to the maximum I have one suggestion.

If you can download your "RAW LOG FILE" using WSFTP or Hotdog HTML editor you can skim browse through your log file to try to find any "unusual" entries, just using your eyes and scrolling through the log file in Wordpad or similar editor.

The raw log file is a compressed GZ file and the member would needed to be extracted with an appropriate utility under Unix etc, or some say Winzip (for Windows) or 7-Zip (which is also for Windows but is free and "correctly" does the extraction restoral of the original file.

Visually scanning through your log file, its format is "roughly" as
IPNumber DateTime GET yourfile Referrer-site User-agent
merely watching yourfile and the Referrer-site you can "usually" notice when things are not occurring in a "natural" order as when someone is actually viewing or visiting your site. If you do your own website programming you should know what links and images and sounds are on any particular page.

When you spot something unusual, then you can copy and paste that particular line into Notepad (or similar) for subsequent and further investigation. Once you have collected your "unusual" entries then you can either look up the originating IPNumber or check out the Referrer-site.  The site at http://combat.uxn.com/
has several "tools" for IPNumber lookup.... their IP Whois often doesn't work, but I use ARIN for US, Ripe is Europe, Apnic is Asia/Pacific (including AU/NZ).

Hopefully this will be a starting point for you to determine if a site at (example) http://www.example.com is linking to your bigimage.jpg at your site.... IE, if example.com was just GETting that image but not the other images or html page that it is contained upon, then you could probably assume a link from their site to your image. Simply check out their site/url given in that Referrer entry in your log file.

There's many ways to stop HotLinking (theft of pages, images, etc) in the Cpanel and it can be done via the .htaccess file. Depending on what you find from viewing  your log file will depend on how you deal with the issue of High Bandwidth, possible theft (of bandwidth) or copyright violation etc.

Hope this helps and maybe others or support can help you out too. This may be enough of a start for you.

Regards.