Are we certain that the client only needs access to hansaworld.com on port 80? I have seen several instances where e-mail validation works, but users are not then able to log in using their Standard ID, only their old username and password. The server is in the cloud and has full access to all the required IPs and ports, which suggests to me that something else is required on the client's firewall.

This appears also to have an impact on global users. When they try to switch company, they get "Very long string in getfield" errors. However, when I log in to their system as a global user, I can switch companies without any errors.

"We never change these IP addresses."
This isn't quite true, two of the IP addresses have changed recently, although it sounds like it wasn't HW who changed them.