The iptables and proxy options would be good, except our router is a PC running the MikroTik RouterOS.

It has a built-in proxy and bandwidth shaping, both of which we're using. The problem isn't so much one user taking over all the bandwidth as taking over enough of it to annoy everyone else.

Only downloading outside office hours is troublesome because we're in Nigeria and there's often no electricity outside office hours.

I'm starting to think that the system could just start downloading when the router reports that the link is quiet, stop if it gets busier and then resume later. I'd include an overall bandwidth limit by time of day as well.

I was sort of hoping somebody had already invented this wheel...