I have had multiple occasions where the responses include an IP that is suspect (crawler, bad actor, etc.) and the traffic logs showed they hit the site using a valid Token. 
These attempts are from someone that would never have access to the Tokens. Any idea how this is happening ? 

Thanks 

No,
Except some mail link checker (this AWFULL outlook.microsoft robot …)

Maybe some of your user have their mail system hacked.