We have not solved the problem, but we have found a workaround.
Originally we had about 100 accounts, 95 web mail and 5 Outlook (POP3).
Every day at the end of their shift, each of the 95 would send an email with a 10mb attachment to their supervisor(s) generally 2 of the 5 POP accounts (so at 4pm and 9pm there would be a huge peak in traffic of emails from
worker@abc.com to
supervisor@abc.com).
We changed the 5 POP accounts so that emails were forwarded to another domain, without saving a copy on the server, and added a second account to the supervisors' Outlook.