Not looking for suspects, but 18.104.22.168 just did a full mirroring pull from the primary server overnight, over http. There is nothing explicitly wrong with that per se, but if you are doing such a thing, please:
1) Use one of much higher bandwidth mirrors to pull all the data from
2) Let me know before you do it and I'll give you rsync read access that all the mirrors use. It is more efficient and won't abuse the server as badly.