One client had a problem because there was a once-a-month backup of a database over the internet. This was so large that it saturated their 5Mb bandwidth for hours. Since they also had two dozen client websites accessed by the public, I created a rule (on the External interface) that guaranteed HTTP/S outbound traffic at least 3Mb, and that solved the problem for their websites. I then created a rule that guaranteed outbound browsing requests 1Mb, and we had no more problems. The backup got all the bandwidth not needed for the other processes, completing in almost the same time and the users browsed with no problem. A final tickle was to guarantee a few hundreb Kb to outbound email, just in case.
We had a problem with one user who was abusing download bandwidth. We "hobbled" him, just as Barry suggests, limiting him to 1Mb.
I am facing a similar problem here. Could you describe in more detail where and how you created your rules? I am having diffculties to understand where to differentiate between rules for outgoing or incoming traffic.