Celerra + Centera issue related to archiving

So I have an issue which is driving me  crazy.  Here is the setup:  Celerra NS-480 (100% CIFS) -- CTA/Rainfinity -- Centera.  The NS-480 has data which is archived to the Centera.  The connection between the Celerra and the Centera is configured as passthrough, which means reads of archived files are pulled from the Centera and not rehydrated.  However, if that file is changed, then the file is written to the Celerra and not sent back to the Centera immediately.

Some file systems on the Celerra are getting pretty full, with less than 10% free space. So archiving is an immense help in saving space.

Here is what has been happening for the past 3 months, and it has happened about 4 times:  Some process is recalling a large amount of files from the Centera on to the Celerra.  File system utilization goes up 300 - 500 GB in a matter of hours, and we get really close to filing up the file systems.  I cannot determine what is causing this recall. I looked at the various logs on the CTA, and while the recall is happening they appear to grow really fast. However, the CTA doesn't tell me what file it is recalling, just that CID such and such is being recalled.

I have tried my best to test and eliminate various situations that could cause a recall.  I have tried modifying permissions to see if that rehydrates the files. I have tried searching the Celerra from Windows XP and checking the "search tape backup" option to see if that does anything. Both situations are not causing a recall, at least in my test folders.  The way the shares are structured, no single user can even access all data to modify the files.

I compared some older folder scans (using FolderSizes and WinDirStat) with new ones.  I checked the folders which showed an increased size and I can see that files that were previously archived are now not archived.  I even reached out to a user whose folder showed a lot of non-archived files, and the user said he was on vacation while this happened.

My frustrations is that I cannot even check what files are being recalled, and what is causing it.  Ok maybe there is a rogue process/user amongst the 7000 users who is causing this, but I have no way of even checking that. I have reached out to EMC support, but their official answer has been to check with users what they are doing.  

Any help would be appreciated. Not only does this cause space issues on the Celerra, backups fail as well since we don't backup archived data.