Some things that are off may not really be off, but in standby, and still able to connect and use data.
If you haven't unplugged the modem since it rolled over and the data was used, you should be able to see what is/was connected here...
Though you won't be able to see how much data was used on the linked page you will still be able to see what was connected, which may help point you in the direction of what used the data.
And how can all these things be connecting without the router password being put in?
The only way a device can be connected is by manually entering the information (the password) or using the WPS push button method. Some devices, after having been previously connected, will re-connect at will. You can stop devices from re-connecting at will by forcing them to "forget" the connection, by un-checking "connect automatically" on the device's connection (mostly computers), or by changing the WiFi password. Of course, by doing the last thing you'll have to enter the new password into any device you want to connect.