On any gig link, over the course of 6 hours you can transmit a little more than 4TB one way.. which is 40x more.
There are usually a few layers of resellers so technically the proxy provider can throw their hands up in the air and say they are unaware of any malicious activity.
Someone has a cheap android tv box or similar unpatched thing with your wifi password
(one botnet alone has over 1.3 million android boxes working for it as of this week - https://www.securityweek.com/1-3-million-android-tv-boxes-in... )
Someone start cobbling lists of these so I can block them in a different way.