Right after Summer 2016 holidays we started receiving user complains about monthly data plan being consumed in a couple of days by the email app of windows 10 mobile.

A search on the frontend log revealed lots of requests from the same IP in the form

[15/Sep/2016:10:58:02 +0200] "POST /Microsoft-Server-ActiveSync?eQAQBBAbzrxxWDOFz69NOQuo7CxoBAAAAAADV1A4 HTTP/1.1" 200 35342 "-" "-"
This kind of ActiveSync request differs from other sync calls that show parameters in clear (in the log), and make troubleshooting harder. The only way to find out the affected user is to search OX logs for the IP address, and hope it was not a NAT/proxy/whatever.

Anyway, is anyone else observing this huge amount of traffic with similar POST requests? We've got users reaching 2 GB/day of endless sync, because looking at their usmsession the system just keep trying to sync old mails.