Blackberry users cannot send emails when their email accounts are on the BES (so, same machine)

I added the BESadmin account to all Blackberry users.  I added "Send As" permission but left the other default ones checked.  Should I have removed the extra permissions in this case?  

I noticed that in ESM that the Administrator account is denied Send/Receive As but the BESadmin does have the correct settings.  In the past, on the old BES the administrator account was used instead of the BESadmin.  

Currently, I have the same problem I was having before and now a new problem: accounts on the new email server are unable to receive emails.  This must be one big authentication problem invovling the BESadmin account and the administrator account, perhaps group memberships as well.  Should I be check "inheritable rights in ESM for the Exchange Servers?  What would happen if I gave BESadmin full admin control under the Delegation tab?  Is there a way to remove the deny Send/Receive As for administrator and could that fix this problem?

I knew this was as definite 500 point question :)

How many users do you have on this BES?

Okay, things are looking a little brighter today.  I came across a script that corrected the problem Blackberry user.  This Blackberry user is a member of Administrators and although the BESAdmin account was added to the Security tab the AdminSDHolder account would keep removing it.  What I had to do was add the BESAdmin account with "Send As" permission so that Administrator members would be allowed to have the BESAdmin security rights.  
 
Here is the script that corrected the AdminSDHolder actions that would screw up Administrator Blackberry users.  Note, the "dsacls" utility is part of the Windows Support Tools kit.
dsacls "cn=AdminSDHolder,cn=System,dc=domain,dc=com" /G "domain\BESAdmin:CA;Send As"

Also, I was getting tired of adding the BESAdmin account to every Blackberry's Security tab so I took this little step.  Go into Active Directory Users and Computers, right-click your domain, properties, security.  Click on Advanced, Add BESAdmin, Edit BESAdmin. Change the Apply To: <pulldown box> to "User objects" and opt to allow "Send As".  Now, everyone has the BESAdmin account and there is less room for error.  However, it's important to run the above script so that BESAdmin is inherirted to your Administrators.  Some people apparently tried editing the ADminSDHolder through the GUI and were not success until they used the script.

Couple other notes:
I have around 35 Blackberry users that are still on the old Exchange Server(s) that I want to turn off.  I moved one person over to test them on the new Exchange server and although their email worked their Blackberry did not.  All of the other users are on the old Exchange Server(s) and their Blackberry's work fine.  Seeing how the new Exchange Server is also the BES I am still not 100% certain my problems are completely gone.  I would not be surprised if my other users are not working now because they are not Administrators .  

I'd like to note that the two old Exchange Servers are also Domain Controllers and Global Catalog servers whereas the new one is neither.  

And the strangest thing so far....All of these steps were recommended due to a HOTFIX by Microsoft and...I don't appear to have that HOTFIX installed!!!!

My Exchange Server 2003 version is: 6.5.7638.1 Service Pack 2

I would also like to recommend these articles:
Users cannot send e-mail messages from a mobile device or from a shared mailbox in Exchange 2000 Server and in Exchange Server 2003 @  http://support.microsoft.com/kb/912918
and
BES 4.1 (SP1) - Cannot send mail.  @ http://blackberryforums.pinstack.com/4875-bes_4_1_sp1_cannot_send.html (the thread continued on several pages)


Anyways, I am now at the point where I am going to try and migrate a user over who is not a member of Administrators.  If they fail misserably today.  I'll be back here later =)