Waiting on RIM to get back to me w/ netblocks of the NA BIS servers...
In the meantime, I've denied access to OWA from *.bis.na.blackberry.com
Let's see how much of a load the reverse lookups cause. With this enabled, it has to do a reverse DNS lookup on EVERY connection to determine if it's coming from *.bis.na.blackberry.com. If thats the source of the connection, it is dropped.
Wish me luck