> I'm pretty sure
> none of our systems have been compromised and forwards mail that we
> don't know about.
Yet your sending IP reputation is poor....
Do you actually have data that confirms that?
We've had random problems mailing Hotmail (frequently), Yahoo!
(infrequently), and other places where the mail stream consists of
a low volume (<10/day) of transactional and support e-mail directly
arising from user-purchased services, on an IP address that had
never previously sent e-mail - ever.