If I were you, I would start putting some security measures in place to prevent this type of abuse in the future. I would lock down user accounts and implement complex passwords. Avoid the use of the administrator account. Ensure the AV software is implemented and the signature files are up to date. Learn about the audit logs and the events that are being tracked and above all implement a hardware firewall between your network and the DSL modem.