Okay, here's some more details on the situation:
3 computers use XP, but the problem computer is running LINUX...
It's hard to get him to do any "house-cleaning", whether it has to do with his computer or the actual house. He's not the most Linux saavy person using Linux, so he doesn't update a lot. He's not using Kazaa or anything I've probably ever heard of before. I have heard that he's used BearShare and EDonkey in the past, but I don't think that's what he's using anymore. I would ask him to check whether he's running his card at 10 or 100, but he may not know how to check and he's not very receptive to questions like that anyway. He thinks it's my fault somehow, even though I've shown him the logs as proof and shown him how our bandwidth "normalizes" when he turns his file-sharing off.
Our router is a 4 port Linksys and there is a 4 port switch connected to accommodate the extra person. When I look in the outgoing router logs at the times when the bandwidth is really tied up, it looks something like this:
192.168.1.101 65.49.207.147 42540
192.168.1.101 24.64.142.167 6346
192.168.1.101 81.248.222.172 6346
192.168.1.101 141.156.174.208 6346
192.168.1.101 200.232.207.198 17640
192.168.1.101 217.85.33.162 6346
192.168.1.101 217.85.47.254 6346
192.168.1.101 217.85.42.43 6346
192.168.1.101 216.68.31.98 6346
Where 101 is him, and his are the only entries in the outgoing log. About 10 new entries are added to the log every second. The IP addresses that it shows are almost never the same. In other words, every time a new one shows up, it's a different number, so I assume these are people pinging him. The inbound logs are similar, but show the IP address of the pinging party followed by the port they're using.