Hey Kris,
I think that only you or the folks on the .net side can answer that question.
We have folks that consume web services too, but they use an embedded ID/pass.
You'll have to get them to show you their detailed trace logs to see what's happening.
I guess you could enable debugging in SMICM, then tail the /usr/sap/<SID>/DVEBMGS00/work/icmhttp.log and /usr/sap/<SID>/DVEBMGS00/work/dev_icm to at least see something
There are some web service admin tcodes out there too. and a lot of stuff SOAmanager...
NICK