Your teachers might be making backups themselves and those backups go to their private area ... which admin level user can't see.
So query would help ... query mdl_files table for all .mbz files
mysql -u root -p'pass' -e "use moodle;select userid,contenthash,filename,filearea,filesize,timemodified from mdl_files where filename like '%.mbz' order by filesize DESC;" > backups.txt; cat backups.txt;wc -l backups.txt
Teachers could have multiple backups and some very old ones that could be removed.
Also, if running a version of Moodle that has it, recyclebin and admin has 'cleaned up' site .. removing categories and courses in those categories rather than moving those courses to another category. For a while until cron job/task moves those recyclebin backups in to trashdir, more space used.
There is a command line utility called 'moosh' that has an option for deleting files which removes them from sea of files in /moodledata/filedir/ *and* updates the mdl_files table.