Quick test to help narrow down the problem area.
-> Remove the user from the BES (along with mailbox settings)
-> "Attempt" activation on the BB with their email address and any password (the password is not significant to perform the test)
-> Check the users Inbox for the ETP message
Does the ETP message arrive?
if no, the problem is between the BB and the users Inbox
if yes, AND the message is not altered or edited by a spam filter then the problem is between the BES and Exchange
Have you ever used IEMSTEST.exe? KB02091-How to use the IEMSTest.exe tool to verify that the BlackBerry Enterprise Server service account can access user mailboxes