Is 322 gigabytes traffic for Partial contents normal?

If we'll divide the 322GB on 16 days and 2000 visits we'll get about 10MB per visit. It may be absolutely normal if you have on the site some video or pdf files.

Google Analytics can help tracking the traffic.

We see a lot of requests for "Partial Content" when the document served is PDF. If your PDF documents are optimized and the server and client both support it (mostly likely they do) then all .PDF files will be served as 'byte-range' requests. So even if the entire PDF is downloaded the request will appear as a series of requests for partial content.

My experience is with Apache but I expect IIS is similar.

I think it is extremely unlikely to be abuse.

If you need more details on downloads and you might be able to tweak awstats settings to give more detail than you are seeing by default. Alternatively you could look at analog which is very very configurable and use it forensically to dig into this issue.

http://analog.cx

But really, I don't think anything is out of the ordinary here.