For a beginning let me say that if they're good you won't be able to track them regardless how hard you try.
How I'd approach the problem is by installing an independent statistics system on the website that allows IP tracking.
Then look for patterns - if there's a lot of traffic from certain IPs: try to match them against agency.
Keep in mind that agencies usually hire a lot of different services. So your best bet would net to use whois and see if anything is registered either for an agency or any of it's employees. Keep in mind here that a single agency might operate as much as over 50 different IP addresses that usually will show as registered to the hosting company, not agency itself. One attempt here you might try to do is matching the whois entries with hosting provider of the agency website or any of it's services.
Another option would be to use geo-localization from Google Analytics and try to see if most of the traffic doesn't come from one or two cities. It might not work though if your website targets specifically into a single site.
Your last hope might be an attempt to find unusual patterns in desktop resolutions or browsers and compare that with average statistics for your country. Say: If 50% of your traffic comes from one specific browser running one specific resolution then something clearly isn't right. But in the end it's hardly a proof that they cannot dismiss.
As I said - it's really difficult problem to solve. I encountered it 3 times so far, and managed to prove guilt only once, and only because the service provider was from small city in the other edge of the country, so it was quite obvious that they generate traffic themselves while looking at the Google Analytics. In other cases I didn't have any proof that would be hard enough to make any demands or go to the court. Hope it'll help though!