The download package tracks the number of times a file has been downloaded. It wouldn't be hard to modify this to figure out how many bytes have been downloaded. You could change the download package to turn read permission for users off once a limit's been reached, and add a scheduled proc that runs monthly to turn it back on.
