Data out of control

I took a data package of 20 gig to be used at my office. It is password protected. My network was disconnected, and upon investigation was told by Vodacom that my data exceeded the allowed 20 gig by 127 gig. thus leaving my with a bill of R 42000 +. I subsequently queried the matter with Vodacom, and the legal department. I raised 2 points as such 1. how do they allow a 20 gig line to use 147 gig in 3 weeks. 2. How is it possible to bill me for data used by a third party when my network is password protected. To date no answer.