Don't forget there is a 5V --> 3.3V switching regulator at the input to the Photon, so if you drop Vin to the 3.6V minimum, you are putting this device into a funny state. I think the switch regulator is entering a linear mode trying to produce 3.3V from 3.6V input and the regulator itself is consuming the extra current.
It would be easy to verify this on a modified Photon, but difficult on a stock one. You could back drive the 3.3V pin with a 3.3V source but the regulator will consume current in that mode too. Removing the regulator entirely would work, of course.
Also, your DMM may have a uA scale, but making good measurements in that range is hard, usually requiring a Kelvin connected shunt. If you paid less than about $2000 for the DMM, I would be suspicious of the numbers it produces in the under 10uA range. The uCurrent Gold is nice; it is really a low-burden amplifier attached to a Kelvin connected to a shunt.