Its Exchange 2010 SP3 with a multi-tenant setup. If user logs in on OWA, ABP is applied fine, only the user's tenant GAL and tenant address lists are available. If this same user logs in on Outlook, all the Address Lists and the Default GAL is visible, that is, the security boundary is broken.
This is true regardless of outlook is in cached mode or not, downloaded an OAB or not.
Thanks for any advice.