Ok, just figured it out. I guess in the end perseverence and lots of "what if" experiments pay off (albeit, from RIM standpoint I doubt this would prove to be a successfull business model in the long run).
here's what I found out/did:
1. The problem with resolving mail recipients was due to problem on exchange server. Once the exchange server was rebooted, I was able to log in on BES box using other admin account (the one that's not BES admin) and was able to configure MAPI profile (as well as resolve mail recipient/server successfully) and able to attach to BES Mgmt console.
2. I had user VPN into our network from his laptop, connect his BB via USB cable to his system and start desktop manager, at which point it prompted to generate new encryption key. He did the usual "move the mouse" thing and afterwards I asked him to launch desktop re-director.
3. Once desktop redirector started, his BB was activated and synched up, at which point it showed up in BES Mgmt console as "running".
I had user disconnect and was able to send/receive messages to/from him wirelessly, without BBdesktop redirector.
Lessons learned: when all else fails, abandon wireless activation and go for wired (and yes, do reboot)