Im sure as a potential stopfix.. u could make iptables count bandwidth and when u hit ur total stop everything..
im not sure if iptables has the ability to generate emails, but u could write a cron job to check the iptables count, and if it is getting high report it
_________________
ServerAdmin -
www.our-lan.com
"Diplomacy is the art of saying nice doggy whilst looking for a really big stick"
"In my experiece, any attempt to make any system idiot proof will only challenge God to make a better idiot"