Push e-mail using carrier/celluar/mobile data allowance on WiFi

I think this may be something to do with Exchange support on iOS 6, but haven't been able to do the necessary checks on earlier versions.

My carrier (O2 in UK) told me I was running out of my 100MB data allowance less than 1/2 way through the month, which I've never done before.  I didn't think I was using much more than normal so I did some investigation.

Using the "System Status" app, I could see that there were open TCP connections to Google servers using the Carrier connection, as well as the same connections over the WiFi.  I use Google Apps for e-mail ,which uses the Exchange setting, and have three e-mail accounts running all of which use push mail.  There is also a Gmail account using Fetch and an iCloud account also using Push.

The iCloud account seems to switch between a Carrier and WiFi connection, and could contribute, but no hard proof.

To try and see what the data usage really was, I made sure I was no WiFi over an 8 hour period and recorded the results.  This was with Mobile Data On and e-mail set to Push.

Sent - 948 KB

Received - 1014 KB

So as my carrier adds up these to work out data usage there is a total 1962 KB off my allowance while connected to WiFi.  Which would mean around 3.8MB per day if my phone is on for 16 hours a day, even if it never leaves WiFi range. So 30 days usage without leaving WiFi range and I still go over my allowance by 14 MB.

Just to check the difference when push is switched off, left the phone switched on over night charging and recorded the usage.  I checked that there were no TCP connections over carrier before I started.

Sent - 54 KB

Received - 54 KB

This works out to be around 216 KB a day, and 6 MB a month.  A huge difference!

So, has anyone else seen this?  Any comparisons with pre iOS 6?

Is there another bug in the Exchange code?