Was your node restarted not long before this overuse was observed? Apparently the filewalker process that can/will run at node start recalculates the values with better accuracy and may find that a node is overallocated. This will clear with time as further ingress is stopped, delete requests come in, and trash collection is run. Seems this (among other items) contributes to why it is suggested to only share a portion of your disk and not 100%. See the posts directly linked here from the thread jammerdan previously linked to.