we have a hosting user, who has overused bandwidth in directadmin control panle due to emails but whenever we analyse the mainlog or reject log we don't see that much activity by his email id

plzz help