by Ken Task.
Using whatever tool you have to browse the database, view the mdl_files table. Contained therein is all the meta data for files uploaded to the system. There is a column for filesize. Sort by that field, and then look at the meta location of the file ... component/filearea where uploaded. If the file uploaded was in blogs, for example, one would see 'component' = blog and 'filearea' = attachment.
'spirit of sharing', Ken