We have 5 Groupwise Servers spread around the country that all connect to one central Groupwise Mobility Service Server

Servers running 14R2 and the GMS Server is also on 14.2 One of our servers on Sunday morning starting dumping a load of data onto the GMS Server, I cannot work out what user is doing this or why... It's been going since sunday morning and we have had it send 1.7gb of data to the GMS Server in the last half hour over our internal WAN.

Any Ideas on how I can identify which user is doing this not really sure how I can work out what it is?