Tomato on a $30 Linksys will give you live graphs of each IP and bandwidth consumed overall or over particular policies, ports, etc. If that's not enough it also has syslog support which can do wonders with Kiwi or similar. If you're not on a consumer level router, then all SMB and higher should support syslog out of the box, which should be enough to tell you which user/computer you're looking for.