Help! I am having issues using Enterprise Activation for my Blackberry.

I am running a Blackberry Professional Express Server (V4.1.4.17)
Port 3101 open
BESAdmin is granted appropriate rights (Send As, Logon as a Service, Logon Locally) and is not in any special groups
I am running Exchange 2007 SP1
Outlook and Exchange Management tools are not installed on the BES, only the Exchange MAPI CDO in line with the installation instructions

I am using T-Mobile UK and I have contacted them three times now to ensure that our devices are on a BES plan, not the BIS plan. Each time they have confirmed that this is the case, yep we are on the more expensive BES plan.

The user is not in any special groups and if I use a workstation and login as BESAdmin I am successfully able to use send-as to send emails as the user, from Outlook and OWA.

After several failed attempts at OTA activation I tried activation using a USB cable and the Blackberry Desktop manager on my workstation. Through the USB cable it provisioned the Service Book information about my BES. Once it had this, it would then recieve email OTA but is unable to send.

Having got this far I decided to try OTA activation again.

When I select "generate and email activation password" it sends the email to the user account. I then enter the details in the Enterprise Activation screen and the Blackberry sends the ETP email with the ETP.DAT attachment to the user's inbox. Ironically this email then gets delivered back to the Blackberry Bold and sits in its inbox. The emails stay in the Inbox and do not get processed further.

The user's mailbox is configured to have the email address in its whitelist so it never goes in the Junk mail folder. An email gets delivered every 20 minutes to the inbox and after the fourth one it fails.

I have been tearing my hair out over this because it is half working and half not in that I can get email delivered to the Blackberry but not be able to send from it and OTA activation doesn't work.

If I were on a BIS plan, I would not expect my BES server to be able to deliver email to the Blackberry handset, which it is currently doing. If it were a send-as permissions issue, I would not expect to be able to open or send as in either Outlook or OWA using the BESAdmin account but this works fine.

I have been through all of the KB articles on checking the correct permissions are set and they all appear to be but still no luck.

I have run the following utility and get the following result:

C:\Program Files\Research In Motion\BlackBerry Enterprise Server\Utility>bbsrptest srp.na.blackberry.net
NetworkAccessNode is srp.gb.blackberry.net.
Attempting to connect to srp.gb.blackberry.net (193.109.81.33), port 3101
Sending test packet
Waiting for response
Receiving response
Checking response
Successful

I am desperately seeking help now because I don't know what else to try.

This sounds like a permissions issue on the besadmin service account.
Have a look through these KB entries:
KB13852 - Identifying and troubleshooting enterprise activation issues - Port3101.org : Your BES Connection

KB02276 - Assigning permissions for a BlackBerry Enterprise Server service account - Port3101.org : Your BES Connection