I suggest disabling upnp (universal plug'n'play) because this allows the router to be configured for port forwarding without your being aware of it - whether or not this is enabled makes no difference if there is nothing connected to the router. With nothing physically connected to the router, the only way to get substantial bandwidth usage in either direction is via wireless - which is the reason for the change in encryption key - that would immediately break any and all wireless connections, even those you have may have forgotten about. What I would have done as step one is a reset of the router to factory default and a reconfiguration - making sure that upnp was disabled and the wireless encryption key changed. The router does have a security system hard wired to it (currently disconnected) and a Sonos (again, disconnected) that we had to do some playing around with to get working so wary of going mad to start with in case I stop those working! Many thanks for any help or thoughts you can offer.

Can't find how to do this, can anybody help?! Also, are there any other precautions we could take?

I think it would be very, very unlikely that they could be doing so wirelessly (large grounds, no way to get within wifi range) so the ISP suggested we make sure that remote management of the router was turned off (done successfully) and that we block port 53 to incoming traffic.

We ran tests such as disconnecting everything from the router and sure enough, large uploads made with NOTHING connected to the router! We talked to our ISP who suggested it was most likely someone accessing our router to upload info. A few months ago, we noticed that there was significant upload useage on our connection when it was not possible for it to be us using it. I wasn't clear - I meant blocking all UDP port 53 out from the router to the WAN.

You are right, you are configuring the correct way. Of the blocked wifi router? Blocking UDP Port 53. Which finds open port and tunnels through a port ( usually udp 53). Openvpn port 53 bypasses allows restrictions ( find similar.

Sg3525 ir2110 smps rarest