If you use any netstat utility you'll quickly discover there is some unsolicited net activity on iphone even when no utility or program is open. On mine there is open socket to push.apple.com (often "hanged" - ie like on pic below open for 46 min with data flowing every few minutes), and every few minutes bunch of http connections is being open to aggregator urls at amazonaws, akamaitechnologies and carriertelia with nothing open and no automatic data retrieval of any kind setup
Image
It's not a lot, but it will add up in terms of data usage...