Exchange 2003 Permissions Error when attempting to forward emails

Question

Server 2003 R2 (fully patched as of 11/2013) running Exchange 2003 SP2 (Built 7638.x2) on ESXi 4.1; WinXP clients and Server 2003 Terminal Servers running Outlook 2003; Domain and Forest are running at 2008 Functional Levels.
Occasionally, some users are receiving this error message: "You do not have sufficient permission to perform this operation on this object.  See the folder contact or your system administrator" intermittently when attempting
to 1) forward email both to and from senders/recipients inside and outside the domain, 2) When attempting to modify the subject of a previously received email (I didn't know you could do that), 3) When attempting to open received attachments.
There is no discernible pattern to the users or the original senders of the emails.
Most of the results I've found when searching relate to NTFS permissions or a ReadOnly propery on items in the users's profile folder, or sending on behalf of another user - these either do not apply or have been verified as not the cause.
During the initial rash of problems when there was a problem with an attachment and we absolutely needed it, I was able to connect to OWA using a special administrative account with access to the mailbox, open the attachment and log out.  Once I had
done so with this account, the end user was able to open the attachment on their own without a warning.
Changes made to the environment prior to this issue that may be related (nobody remembers when exactly this started, so I can't state that it definitively happened after this change):
All servers were virtualized on ESXi 4.1 in late 2011; subsequently converted and migrated to Hyper-V Server 2012 in early 2013 (with the exception of the Exchange and SQL servers).
All 2003/R2 domain controllers demoted and removed; DFL/FFL raised to 2008; SYSVOL replication was migrated from FRS to DFS-R.
Troubleshooting steps:
Exchange server and affected client computers have been restarted several times; the various exchange services have been restarted; permissions on the mailboxes and AD objects have been verified; event logs are generally clean with the exception of ActiveSync
errors for a single user not currently affected by forwarding emails, there are no other errors reported.
Per recommendations on another forum, I had enabled several diagnostic logs in the diagnostic logging tab of the server.  Unfortunately not much was found in the Application log even after filtering out the basics.  There were occasional errors
referencing User A failed to modify an item in User B's mailbox because access was denied; however, I was unable to correlate these errors to any reported incidence of the above message.
I created a new mailbox database on the same server and migrated all the mailboxes to the new database, there was no change; users immediately began seeing these errors.
Over a holiday weekend, I then spun up a new Win 2003 R2 server, with a fresh installation of Server 2003 R2 (also fully patched through 11/2013) running the same version of Exchange 2003 SP2 this time running as a virtual guest on Hyper-V Server 2012. 
I migrated all mailboxes from the original mail server to the new mail server and it appeared that the problem was remedied; however, it has slowly started up again and is starting to become more frequent.
I'm really at my wits end with this problem and would like to get it resolved before we purchase and install our new Exchange Server later this year.

Answer 1

Updates
Users have reported that they can forward the email from OWA; even after doing so, they are unable to forward from Outlook.  So either my previous notes on the issue were wrong, or this is just more of the "intermittent" nature of the problem. 
I will have to investigate what logging options are available to me at the Outlook client level - any thoughts on that subject are also welcome.
Users have now reported that a previous (rarely used) workaround (the administrative account opening the email in OWA) no longer enables them to view attachments or forward emails in Outlook.
I'm still adjusting the various diagnostic logging settings to see if I can spot an event which corresponds to a reported occurrence.  The most unusual warning reported is the following:
Source:MSExchangeIS Mailbox Store
Category: Access Control
Event ID: 1029
[email protected] failed an operation because the user did not have the following access rights:
'Delete' 'Read Property' 'Write Property' 'Create Message' 'View Item' 'Create Subfolder' 'Write Security Descriptor' 'Write Owner' 'Read Security Descriptor' 'Contact'
The distinguished name of the owning mailbox is /O=DOMAIN/OU=FIRST ADMINISTRATIVE GROUP/CN=RECIPIENTS/CN=USER_B. The folder ID is in the data section of this event.
However odd these occasional warnings are, they do not appears to correlate to the reported permissions issue.  Everytime I've seen one of these events, I've inquired with "user_A" to see if they've recently seen the popup and in each case they have
not.