Exchange 2013 Non Deliverable Messages do not show correct information

Question

I tried looking around for a solution for this but have been unable to. 
We have a new (1 month old) single-server installation of Exchange 2013 CU5, running on server 2012. It's in coexistence with an Exchange 2007 box. All users, groups, and everything have been migrated, we actually just shut down 2007 today. However, Exchange
2013 never seems to give accurate or helpful NDRs.
When someone sends an email to, let's say, a user who has left the company, so their mailbox is gone, the user who sent the email will receive an NDR. However, the NDR will not tell you the user who the email failed to. It shows the sender's account and
says "command not allowed". This happens only to internal recipients. When sending to an external domain, we receive the NDR from the other domain with the explanation that the user does not exist or whatever. But within our domain, we never get
a "helpful" NDR. It's just "command not allowed" and the email doesn't get to ANY of the recipients that it was sent to. Any ideas or help would be greatly appreciated!
Delivery has failed to these recipients or groups:
[email protected] Your message wasn't delivered due to a permission or security issue.
It may have been rejected by a moderator, the address may only accept email from certain senders, or another restriction may be preventing delivery.
Diagnostic information for administrators:
Generating server: mailserver.ourdomain
[email protected] Remote Server returned
'550 5.7.1 Command not allowed'
Original message headers:
Received: from mailserver.ourdomain ([removed]) by  mailserver.ourdomain ([removed]) with mapi id  15.00.0913.011; Thu, 17 Jul 2014 10:18:03 -0500 MIME-Version: 1.0 Content-Type:
text/plain Date: Thu, 17 Jul 2014 10:18:03 -0500 Message-ID: <removed > Subject: RE: ASAP

Answer 1

I just tested, and yes, it happens when sending to any invalid SMTP address within our domain. I also tried sending an email to a non-existant user in our domain from my gmail account and received the same message with "command not allowed". We
are running GFI MailEssentials for spam filtering (on the same server), and I also have content filtering and recipient filtering enabled on exchange. For GFI, we exported the config we had for GFI on our 2007 server and imported it into the GFI installation
on our Exchange 2013 server. Should I try disabling content and/or recipient filtering on Exchange? Should I try shutting off GFI and send a test email?
I appreciate your time and effort on this!!
I did a message trace on the test email I sent to a non-existent SMTP address on our domain and this is what I got... Not sure how helpful this is :(
Sorry, my account isn't "verified" yet so I can't post pictures. I put the output up here for now. http://andyslights.com/trace.jpg