Probably some tab. Buggy javascript sometimes goes into infinite loops, including DDoSing its own website with 0-timeout requests, and no way to immediately tell other than the phone getting warm. You probably can’t see it now that the tab is closed, and I’m not sure if the mobile firefox has access to these features, but on desktop you can see open sockets with sent/received bytes in about:networking, and per-tab/per-addon cpu usage in about:performance, and set up logging for next time. But otherwise there isn’t a convenient chart with per-website data usage hidden somewhere.