Okay, s**t just got real. I've being hacked, and I'm 100% sure this time.
My 425GB account was capped on the third this month. That's 109GB on the 1st, 197GB on the 2nd and 243GB yesterday. I didn't pick up the usage with the email reports as the first one said zero gigs (as basically no time had passed up to the early morning email), for the second report I read the numbers a decimal off (and only scanned it very briefly) and I never checked the third one.
There are three PCs capable of 40Mbps in my home - mine, another wired desktop and a wireless desktop with a damn good wireless card. All three were running GlassWire this month every day automatically at boot. My PC has done 79.7GB (majority midnight data), the other wired PC has done 12.6GB and the wireless desktop has done 22.5GB (most midnight data). That's 114.8GB total, and most with midnight data.
My account has been downloading non-stop at line speed since the month started. No weird connections have been detected by the Ubiquiti interface. And most telling, we've been able to download and stream at normal speeds. The internet would have been crawling if someone was managing to leech off our network at line speed every minute of the day.
Edit: Running the Ubiquiti UniFi controller until the downloading starts again. I will be floored if I detect a neighbour on the wifi. I've bought yet another prepaid account, which I'll switch over to from 7am today.
I wonder how much drama today could hold for me. Fortunately the UniFi controller gets pretty detailed info about connected devices - MAC address, network adapter name and host name. If someone pops up it should be easy to find them. And I'm pretty sure only one neighbour is positioned that 40Mbps off my outdoor UniFi AP is even possible.