Well, it probably is a bot of some sort but why stop it? Maybe it is googlebot or some other good crawler that you want.

You really need access to some sort of log that shows IP addresses and how much transfer said IP address has consumed, or perhaps a log that shows which files have used the most data transfer and go from there.

I use webalizer for this purpose if I do not feel like digging through raw logs. Not sure what their stats offer.