If the hosting company provide cpanel or plesk, you can check bandwidth information from them. If not, you need a web log analyzer.
One way to keep bandwidth thieves from stealing the server resources that you pay for is by using HotLink protection in cPanel.
I have a dedicated server with GoDaddy. On the control panel for the server I can see daily bandwidth for the month/billing cycle. Can also compare against the previous month.