Easiest way to check if its something uploading (assuming his ISP doesnt monitor this for him) is use Routerstats. That seperates upload and download so you can see how many bytes are being transfered in either direction
I saw something similar on my ADSL line at Christmas, all good till additional child camr back from uni, constant face timing of her b/f would kill everyone else's connection.