Monthly Network Transfer of a Host Over Quota

Hi, im using a Linode, i have 3 Linodes with CWP, i been using this for about 3 or 4 years, this is the first time i experience this problem.

I just installed a Script (buy in themeforest.com by a client), but i think this script has security vulnerabilities, We just get a Linode Alert about Monthly Network Transfer Over Quota, in a site that is currently not in use.

I need to know where can i find a log or something that shows, wich file in the script is making this bad use of the host, what can i do to check this, thanks.