Hmmm, maybe the security is not set on his wifi, and a neighbor is using his connection?
No, his security is set, 20 characters long. A great hacker could have cracked it but I'm betting it's a case of the stupid program counting LAN data.
can't be lan. traffic is not measured at the CPE.