How to troubleshoot Mailbox Store edb and logs growing rapidly

Hello All,

I have an exchange organization with about 700 mailboxes on exchange server 2003 SP2 in a front end and back end configuration.

I use GFI MailEssentials for antispam and email security on the front end and for Informations store scanning on the back end.

I have four information stores each in a separate storage group. One of the stores; with 567 users (not well balanced numerically, I admit) has been growing rather rapidly and sporadically the last couple of days. In a given 4 hour period I lost about 1.6GB of space to the edb.

So far, I have checked the following:

SMTP Side:
-There is no NDR looping
-There is no visible spamming
-No open relay
-Normal mailflow

Stores Side:
-no corrupt mail is stuck in a queue
-Exmon shows no user taking up more operations or cpu time than necessary
-when the suspect mailbox store is dismounted, the problem stops momentarily.

Parsing the logs for the storage group holding the information store (collected for the period of increasing databases) using strings.exe (see http://blogs.msdn.com/b/scottos/archive/2007/07/12/rough-and-tough-guide-to-identifying-patterns-in-ese-transaction-log-files.aspx?PageIndex=3#comments) shows some emails occurring the following number of times within the logs collected during the   2 and half hour window:

3716       craiga@supplydirect.net
5583       bradt@supplydirect.net
3229       sales@pps-awb.co.uk
2602       jacheretrade@yahoo.co.uk
1900       mitchell.ackah@mospacka.com
1567          Internal User A
1368          Internal User B
135            Internal User C
All the above have one thing in common, they are suppliers and internal users A and B are supply officers.

Mail tracking shows no mail sent or received between Internal User B and any of the external accounts  but 1 email between Internal User C and craiga@supplydirect.net

Questions:
1. What else should I consider after all the above and what step should I take in resolving the issue?

2. Could a corruption in the mailbox store be the cause of this rapidly growing edb file and Exxx.logs?

Notes:

The following have recently occurred: server disk was replaced following drive failure. The server is in a RAID 5  array

The Active Directory FSMO roles were recently moved from server 2003 SP1 physical servers to corresponding server 2008R2 SP1 virtual servers into a VMware vSphere private cloud.