Could you just set up a cron job to search through the user directories using "find" to find files larger than 100K and simply report the name of the user and the file name to a log file. Then just scan the log periodically yourself.

This wouldn't trap pictures as they're usually under 100K but why would you want to block pictures (or am I being too innocent?).

Another option would be to put a wrapper around the music and movie players on the system to put the name of the user, the file name and when they ran it. You'd want to call the normal player afterwards otherwise people would quickly wise up.

Must admit it does sound a bit draconian at your place.

Mike