Oh hai. I'm the local Microsoft Certified Professional ^_^

You are talking about a Windows network, right? If it's a lot of bandwidth it's probably some ****er streaming audio or running a Tor node or whatnot. Enable a metric ton of auditing. In case of Bittorrent or Tor use I would explicitly look at INCOMING connections, which are very strange indeed on a school network. If it's a website, clear the DNS cache and watch it fill up. If you see anything strange in there, you could probably connect the time it was accessed with who was using what computer at the time.

EDIT: If it's Linux, close the hatches. School networks have no reason to have any ports open besides http(s), mail and possibly telnet and RCP. I don't know how monitoring works there, but regardless of whether you run Linux or Windows, there is no need to spend any money on third-party monitoring software.