Check your outgoing queue.
Check the logs on the exchange to determine whether the spike in bandwidth use is because of a large amount of incoming,outgoing email, or a combination of the two. You might be getting a massive influx of SPAM email that your router/exchange is rejecting, but the connection and some data is being transmitted using up the bandwidth. i.e. there are 10 connection per minute submitting a spam/virus laden email of 50k that is processed and rejected by the anti-virus/anti-spam process on the secure gateway. Even though the message never makes it to the exchange server, 500K/minute of bandwidth are being used up.