OK. Rather than trying to teach you command line...
way to do this is to login to WHM as root, then go to Server Status and click on Apache Status.
You will be given a page that lists all the current Apache connections. Scroll down past the ..... 's until you see the chart of information.
If you have one user that is getting a ton of traffic, it will be obvious, as their website will be listed over and over in the chart under "Vhost." If you scroll to the right of the Apache Status page, you will see that the domain name, and file path of the pages/files being called, are all listed.
A few notes about what you are looking at:
is the IP address of the viewer looking at the pages.
is the domain name of the website on your server that is being viewed.
is the path of the file they are looking at.
Keep clicking on "Apache Status" it to see the latest output. It is in real-time. Most Apache calls last < 1 second, so everytime you click, you should get different results.
Let me know if you have any questions --