Virtual disk s quota is consumed on all VEs without any obvious actions.
Symantec or eTrust antivirus software is installed on the node.
The most possible reason is that VEs files were COWed (Copy-On-Write - i.e. that files which had been made as links inside VE were rewritten with original files from the node) due to antivirus scanning.
Unfortunately there is no way to repair links, but to avoid such behavior in the future please run Virtuozzo Update Wizard and install Virtuozzo updates up to VZU35144