Earlier quoted context omitted.
did you make sure that you don't have the insecure package installed, that pushes the entire database to each client, and instead are subscribing to the data? this is reminiscent of how one one of proof of concept apps was acting a few months back and that was the cause.
Sure, thats Meteor 101 ;) Still, as a developer you need to decide what collections you want to publish (and which parts of each collection) so as to make the application run blazing-fast but also make sure you're only publishing stuff when its needed. This, IMO takes some finessing to get right.
My current gripe is with the spiderable package and phantomjs for seo bots, but that is a different beast...