RIM have released an updated KB for this common problem for BES Admins, where users cannot send emails from their BlackBerry smartphones.

Overview

A BlackBerry smartphone user is unable to send an email message. The BlackBerry smartphone user receives a red x and one of the following errors at the top of the email messages:

Desktop email program unable to submit message
or
Unlisted message error

Cause

Cause 1

Send As permission is not enabled for the BlackBerry Enterprise Service Account on the user in Microsoft® Active Directory®.

Cause 2

Send As permissions is revoked for the BlackBerry Enterprise Service Account on the user in Microsoft Active Directory.

Resolution

Cause 1

The Send As permission is not enabled for the BlackBerry Enterprise Service Account on the user in Microsoft Active Directory.

Resolution 1

Enable the Send As permission for the BlackBerry Enterprise Service Account on the user in Microsoft Active Directory. Please see article KB02276 for more information.

Cause 2

The Send As permission is revoked for the BlackBerry Enterprise Service Account on the user in Microsoft Active Directory.

Resolution 2

Perform the following steps:

1. Remove the BlackBerry smartphone user from the Microsoft® protected group.
2. Enable the Send As permission for the BlackBerry Enterprise Service Account on the user in Microsoft Active Directory. Please see article KB02276 for instructions.
3. Allow time for Microsoft SDPROP process to run. The default for most Microsoft Active Directory environments is 60 minutes.  SDPROP is the background process designed to compare the access control list (ACL) on users and groups which are members of protected groups. If the Send As permission is present after 60 minutes proceed to Step 4. If the Send As is removed see article KB12309 for more information.
4. Allow time for the cached permissions to clear for the users mailbox. The default for most Microsoft® Exchange Server® is 2 hours. One of the following methods will allow enough time for the cached permissions to clear.

Note: For a complete list of protected groups visit support.microsoft.com and search for protective groups or click kb817433.