Exim times out sending relay traffic

We have been using Astaro for some years now, but are trying for the first time to implement mail security. Most of it works well, but when our own staff are outside the office and use SMTP to send a message to an outside party (i.e. authenticated relay traffic), the messages wind up in the SMTP spool and repeatedly fail with timeouts from the destination email server. E.g.:

This happens for many, if not all, external destinations (I can't find any that worked properly). But traffic sent via the internal exchange server (be it from people inside the office, outside staff accessing via OWA, or outside staff using Exchange over RPC/HTTP) works fine.

Testing with nslookup shows that the addresses are correct, and I can telnet from an internal machine into port 25 at hotmail and get valid reponses -- I have tried using both HELO ourcompany.com and HELO firewallmachinename.internaldomain.local and don't get kicked off, so it's not because of how the SMTP proxy identifies itself. The relay traffic is set to use AD-authentication, which is apparently working fine, as the proxy has accepted the relay and is trying to send it out.

Could the SMTP proxy be sending out on the wrong interface? The default gateway is correct, and everything else works fine.

The SMTP proxy log provides no further info:
Short of putting a managed switch in between the firewall and the modem and running wireshark to see the actual exchange between the proxy and the other server, how can I see what's actually going on?