If the file is opened you could try and find it watching
Code:
wach -n 10 'lsof -w -n +D /home|awk '{print $7, $NF}' | sort -grk1'
(man lsof for flags)
else if you want a global indication and if it's filling fast:
Code:
watch -n 1 'du /home/*'
else
Code:
watch -n 5 'find /home -type f -mmin 5 -printf "%k %p %c\n" | sort -grk1 | head -10'
Values "-n" and "-mmin" might need tweaking to better match your situation.