if you have a sample e-mail I would go to Message Tracking within ESM. From here, you can at least see if it’s hitting the mailbox at all. If its not, then something at firewall or spam relay appliance (if applicable). AT least that would be the start to look.
You can turn off forwarding on the organization level in Exchange System Manager, but I do not know if that is what you want to do. That will affect everyone.