try this.
on your exchange server
can you try to run command
nslookup
set type=mx
sub.domain.net
can you tell me the result?
i wonder where is it pointing to.
i wonder when the exchange server pick it up as it own and decided not to forward it to outside but look inside..