I just discovered something odd.
I ran slapd -d 256 on the provider, then started the replicator, and then did ldapmodify and look what i found:
50152ae5 conn=1020 op=0 BIND dn="" method=128 50152ae5 conn=1020 op=0 RESULT tag=97 err=0 text= 50152ae5 conn=1020 op=1 MOD dn="uid=nofilter@punchyouremployer.net,ou=emails,dc=webgate,dc=net,dc=au" 50152ae5 conn=1020 op=1 MOD attr=cn 50152ae5 conn=1020 op=1 RESULT tag=103 err=8 text=modifications require authentication 50152ae5 conn=1020 op=2 UNBIND
BIND dn="" on the first line
It's using anonymous! How is this possible?