High broadband usage figures

[#1]

I am seeing some puzzlingly high usage figures in my account. For Wednesday, Thursday, and Friday last week, our usage is reported as 13.04GB, 10.12GB, and 10.57GB. This is a lot of data. If I've done my sums right, 13GB is equivalent to occupying our full download speed (currently 17Mb/s) for two and a half hours solid. We have done nothing that heavy, and it way in excess of our normal usage.
I have today turned on the traffic counter in the router. It shows peak usage so far as 112MB; PlusNet report it as 560MB.
So could someone be hijacking our Wi-Fi? I don't think so: the connection events in the router's log are all for our own devices, and any illicit traffic would in any case show up in the router's counter. Now the counter is on, I will see what it reports tomorrow. Meanwhile, is anyone else seeing this – or is it just me?
Thanks in advance for any comments and suggestions.
Edit: PN's usage figure has risen again (perhaps due to the four-hour delay).

[#2]

The problem continues, so I have submitted the following ticket via the now well-hidden and much-diminished Help Assistant:
Hello.
BROADBAND USAGE FIGURES
Since about Monday 24th August, your figures for our broadband usage have been very high, and do not correspond to our actual usage.
- Yesterday, for instance, 3rd September, the router here logged 136 MB of ADSL traffic. You report it as 2.15GB!
- For Wednesday 26th August, you report 12.8 GB - which would be about 2.5 hours solid at our full download speed. We have done nothing that would generate such traffic.
- And you say our total use so far this month is 63 GB, which is well above the <=~30 GB of previous months. [And we are only 2/3 through the billing month.]
Will you please investigate? Can you trace the destination of that 12.8 GB, for example?
Thanks for your help,
[Petard]
I'm hoping for a helpful reponse.    
Edit: corrected typo.

[#3]

Could it be Win 10 redistributing it's self

[#4]

No! That would be logged by the router.
@Petard
I'd suggest powering your router off shortly before midnight and leaving it until the next morning to check what usage is recorded by Plusnet when you power up the next day.
Have you ever given an old Plusnet supplied router to someone else and if so are you on fixed or dynamic IP?

[#5]

Thanks for your comments.
It's not software patches, I think - the PC and our devices are set not to download patches automatically (I patch them manually once a month). I have not signed up for Windows 10, and have uninstalled the 'nagware' patch for it. All such traffic should in any case show up in the router.
The router is not one of PN's, but a Netgear DGN2200. It's firmware is up to date (V25). I did turn it off for three hours on Tuesday to see if that solved the problem. It hasn't. Unfortunately, I have no other router available. I try to turn it off as little as possible - it is slow to pick up the time from its NTP server - this can take days and there is no way to force this or set the time manually - and the logs aren't much help without date and time attached.
I may turn it off overnight and see. PlusNet are logging a surprising amount of use overnight - sometimes hundreds of MB - yet the PC is switched off at night, and the Wi-Fi is killed by a timer between 23.30 and 06.30.
I have wondered about viruses and runaway processes - but a full virus scan shows nothing, no process is running wild, and the router's counter should show such traffic anyway.
All this may be relevant to others, so will keep you posted.    
Edit: forgot to answer some of the things you asked. No, I have never given a router away, and I'm on a dynamic IP.
Edit to edit: interesting point, though, spoon whittler. It won't hurt to change my PN password.... Thanks!

[#6]

Probably a bit tin hattish, but before you change your password, to be absolutely safe, I suggest you go to https://portal.plus.net/automatic_hardware_setup/index.php and make sure it is disabled.
If Plusnet have given someone else a router with your login (it has been known), disabling and then changing your password will fettle it.

[#7]

Thanks again.
I've checked auto set-up, and it's off.

[#8]

Thanks once again, spoon whittler. It looks as if you've set me on the right track. On the two full days that have passed since I changed my password, PlusNet's recorded usage has matched that in the router (~20% inflated, it's true, but that's a big improvement on being too large by a factor of up to 26).
It looks, therefore, as if someone else has been using my account. Now, I am sure I have not leaked my login details. I have been through the box for recycling, and find I still possess all the devices that could have been programmed with my account details. And I have changed my password from time to time anyway.
So the ball is in PlusNet's court to explain how someone could be using my account. I have brought my (so far unanswered) ticket up to date with this new information - and perhaps it's time they took an interest in this thread.

[#9]

I've been through your connection logs and on 21CN lines we can see the line ID that is connecting on your username, the only connections are from your line so there have been no other routers connected using your details. I've gone all the way back to the start of July to check that.
I'm checking 2 different sets of data against each other at the moment on our side and the usage data isn't showing what I'd expect. Let me do some more digging, I'm going to move the ticket to myself for now while I take a look.

[#10]

I've a suspicion that usage logging is going funny on some of the bng's - when I've seen blanks in my usage I think I've been on pcl-bng01/02. Perhaps it's getting logged to another account?

[#11]

Thanks, Chris. I feel much happier now I know someone's looking into it.
Perfect match so far today - 46 MB and 46 MB (PC was off all morning). So perhaps the 20% 'inflation' is meaningful too.

[#12]

It might be a few days before I get more info, but as you're on Unlimited it should impact you too much.

[#13]

Yes, I'd be squeaking a lot more if I weren't.   

[#14]

Do you do much downloading around Midnight and 8am (the start of off-peak and peak periods)?

[#15]

Could be using the iPlayer up till when the Wi-Fi is turned off by the timer at 23.30; after that normally there should be no traffic.
I download a big batch of podcasts at about 07.30 on Saturday mornings, patch the PC early on the first Sunday of the month, the Android stuff on a Sunday mid-month. On other days, there should be just a little browsing and e-mail traffic, starting at 07.00, nothing heavy at all.
Edit: forgot to say I've been playing with Ubuntu recently. Some of those patches and packages may have been early morning (after 07.00), can't remember.