Hello,
Not all of the services are included in DirectAdmin's bandwidth totals. Services such as pop, imap and smtp arn't included in the bandwidth totals. On top of that, there can be a lot of traffic to the main IP sites (apache) which arn't logged for any user... I know that with all of the Microsoft server attacks, our apache can easily use up one gig of useless break in attempts on the IP, which won't be counted against anyone. There is also the local downloading of thing using wget, fetch or up2date which arn't included. The little backdoor things can add up pretty quickly, but are just a standard overhead for running a server.
John