A lot of sites unknowingly host images that external sites use; you should catalog what's being accessed with a decent statistics logger (such as awstats) and see if this may be the case; it was for us and we trimmed off like 30gb/traffic per month by locking things down