Question : Your account in Microsoft Exchange does not have permission to synchronise with your current settings

This issue seems to closely match KB817379; however the unusual situation in this case is that one user can synchronise successfully. If their account is then added to one of the other two Windows Mobile 6 devices, then the synchonisation works also.

There appears to be no difference in the user access rights between the three users concerned in AD and the other users can connect to OMA and OWA without a problem, either from their remote PC or from their mobile device via IE.

Does this KB solution still provide the best route forward, or could there be something else which is causing the problem? There is also a Draytek 2800 router in place with various firewall settings applied, but presumably this can not be blocking traffic given the above situation.

For reference the connection is using SSL and the local SBS 2003 certificate has been copied to each device and all three devices appear to work, but only with one user's account!

Answer : Your account in Microsoft Exchange does not have permission to synchronise with your current settings

First of all. Rerun the CEICW (Configure E-mail and Internet Connection Wizard) to fix your settings on the SBS 2003 server.  This usually fixes this issue:
http://www.ureader.com/msg/1175545.aspx

Make sure the other two users you created have the Mobile User template applied to them as well.  

Have you verified the first 3 steps here:
1. a. On your Pocket PC 2003-based device, click Start, ActiveSync, Tools, Options, Server and check the box This server uses an SSL connection.
2. On your Smartphone 2003-based device, click Start, ActiveSync, Menu, Options, Server Settings, Connection and check the box This server uses an SSL connection.
3. Verify that host headers are configured correctly.
And I would still follow KBKB817379 after you verify all settings.
www.pocketpcfaq.com/faqs/activesync/exchange_errors.php