If you're using SmartEvent, you can definitely figure out what user is using the most bandwidth from some of the reports.
Even SmartView will give you some basic details with the right search query.
All my users are on one subnet, so it's easy to narrow down which one 🙂
Granted, these are IPs and connections, so it's not "bandwidth" but can be helpful if you don't have SmartEvent or don't want to use SmartView Monitor.
More details on SmartView Monitor here: https://community.checkpoint.com/t5/General-Management-Topics/Total-bandwith-of-interfaces-and-each-...