My total bandwidth is 65GB and I have only 165 sites. One of the sites is eating the bandwidth and I am unable to catch that site. I wrote a script which calculates the size of the log files of each website and the site having maximum log size is supposed to be 'heavy traffic' site. I stopped the these sites but no effect. MRTG shows the same graph. I am also using windows performance monitor and hooked my NIC card and it also displays the same activity. There is average 100Kb/Sec UPLOAD to the server and download is always an average 1Kb/sec.
For regular servers, extremely high incoming vs outgoing ratio is not normal. Unless you have an application that utilizes that kind of incoming bandwidth, your server is probably being DoSed. Try analyzing your traffic using network sniffer to find out where the traffic is coming from.