I may have found the problem. The user had 7 devices activated with Exchange ActiveSync for this account. 5 of these devices were synching simultaneously. The first four would have no problems, but the fifth would generate the error every 30 seconds. Had the customer turn off one of the other devices and the error went away on the last device.
So, apparently there is a limit to the number of active devices using Exchange ActiveSync on the same account, and exceeding that limit results in the HTTP rsp "403 Forbidden".