Mad idea: It's possible to get a listing of domains contacted if you register for the free OpenDNS. Set the router to use that DNS rather than BTs ( I don't know if that's still possible with hubs as I avoid them) Keep one PC running overnight with the tiny OpenDNS dynamic IP reporting app running. Next day check the domains visited at OpenDNS, nice timed graphs of DNS activity too.

Won't work if the user has set a DNS in win settings rather than auto use the routers unfortunately.

That may help determine if there is a torrent maniac sitting outside in a car and what time they are there, or if there is nothing showing for DNS use and it's a BT gremlin.

https://www.opendns.com

You can get unlimited packages for peanuts these days so why do they insist on incurring extra charges and use a limited package?

Seems madness for a charity does that - to me anyway