The quick summary of this problem is that it appears Virtualmin is counting bandwidth for sub-domains (not sub-servers) multiple times. This prevents accurate usage of bandwidth monitoring.
It appears that since Virtualmin uses the same log file for sub-domains... when bandwidth is counted for each sub-domain, the same data is counted over and over, once for each sub-domain.
Basically, one of our users created "domain.com". So far this month, it's used 100MB of bandwidth. They've also created "sub1.domain.com", "sub2.domain.com", and "sub3.domain.com", all of which point to the same access.log.
They're each listing as having used 100MB, or a total of 400MB (the primary domain plus the 3 subs).
Now, I could have Apache log the domain name of the virtualhost, but at first glance it doesn't look like Virtualmin is looking for that.
I can provide further details on request.
Thanks!
-Eric