I had a quick peak at the web server log, it's tiny. The typical legitimate egress from this network is likely somewhere well under 1gb/day, yet somehow these people managed to upload at least 2TB without being noticed

In a well-maintained network an upload like this should have paged someone as it was happening, probably sometime in the first 5-10 minutes. Say your outbound pipe was 100mbit, if it is pegged for 15 minutes I can't see any reason why a small installation like this wouldn't want to know they've just spat out 11GB of data for some unknown reason

Even divvying things up over 14 days (per the age of the data), its still around 6GB/day. This should have shown up in a monitoring graph somewhere, or triggered a page