Need to confirm-interpret some Performance Monitor counter values

We're doing some performance monitoring on our W2K Server because of an issue we have with our accounting software. We get i/o error messages in the application on a regular basis on some PC's, and the software manufacturer says it's probably a bottleneck on our server.  We rather think it's PC related (hardware, application). So we have setup performance monitoring on the server to hopefully find out if the server is the problem or not.

Quick description of the server: Dell PowerEdge 2900 with 2 Quad-core Xeon 2.0Ghz processors, 4Gb Ram, 2x73Gb Scsi 15k rpm Raid 0 for the OS, 4 x 160Gb Scsi 15k rpm in Raid 5 for the Data, 1 hot spare, 1Gb network card, SBS 2003 running Exchange, OWA, File Server, Symantec AV, servicing a total of 20 users, all connected using a 48 port Gigabit switch. We thought this configuration was much more than adequate, and were very surprised at the server bottleneck possibility !

So, following a very good document found in another EE post about troubleshooting performance bottlenecks (http://www.redbooks.ibm.com/abstracts/redp3938.html?Open), we are tracking the primary performance objets as described in their manual, and there are some counters for which I would have a few questions:

1) Is an interval of 15 secs too small when performing monitoring with counter logs (default = 30?)

2) Network-Bytes Total/sec: shows an average around 240,000 and a max of 14,900,000 on a 1 day period from 07:00am to 07:00pm. The guide says that on a Gigabit nic card, this should not show sustained values over 70-80 MBps. Am I right in interpreting the average number of 240,000 as 0.24 MBps and the max 14,900,000 as 14.9 MBps ? Which would mean that it is way below the 70-80 MB limit ?

3) Do we use the average numbers produced in counter logs when checking if we are going over some recommended limits, or do we have to look at the numbers in real time monitoring on the server ?

Thanks.