There are lots of things it *could* be. One of the most common is a failure to obtain the hidden message for the mailbox via EWS. You can see this request in a network trace in your browser (F12 developer tools) or using a web debugger like Fiddler. You're looking for a request from the client machine to the CAS with the parameter "ExecuteEwsProxy" in the URL. This is the client asking the CAS to proxy its request to EWS and retrieve the hidden message. The tricky part is that it when it fails, it does not show in the logging as a failed request; the result code is HTTP 200 because the CAS successfully answered the client's proxy request. However, if you examine the body of the response, you will see what response the EWS server gave for the proxied request, and that will usually contain the error that points you in the right direction. (In my experience it's more often than not a problem with SSL and certificates on the EWS server.)
I hope that helps.
--Chris
