How were you tracking each IP address's data usage? Did you parse the logs every request? Store usage in a database? At the application or webserver level?
Once you added a redirect rule for the IP to apache you'd just check your log and see the IP that was hitting you every couple of minutes poofed for a good few hours.
That's nuts. I suppose you had Webalayzer on a minutely cron job. It might have been drawing more resources than Apache itself!