Yeah, I pretty much figure that the problem is on the BE server as well. One thing I did notice, on IIS, under Exch Virtual Server\ExchWeb...the anonymous account is set to IUSR_servername on the node that is working, and on our node that isn't working, its set to one of our engineer's regular user accounts.
Unfortunately, due to our customer, we cannot fail over back to the node that does work until tomorrow night, and restarting of any IIS services during the day is a no-no as well. They are really tight about these type things.
As far as pinging the KVS server, that's fine. Checked proxycfg a few times, and they are identical on both nodes. And I wish we could upgrade to at least 5.0, but then again, the gov't is holding the cards when it comes to that as well.