EWS & IIS Log - connections

I am seeing 2-3 million hits on my CAS IIS Log coming from a MDM application where normally I get 150,000 per day and half of them are 401 errors to EWS.  In the EWS, just 1 log (about 60 perday), I see the bulk of the log is associated with 1 user (ExchangeServicesClient/15.00.0847.030, FindItem, 200).  For example, the EWS would have 20,000 entries where 16,000 is associated with just 1 specific user.  What would be causing this?  I have reset the user's phone already and reconfigured it.