Alerts will use the Alternate Access Mapping address that the user who creates
them uses. If the alerts are created by a user inside the network for someone
else then they will reflect the internal address. If they are created by the
external user then they should default to the external address. I suspect there
are two possibilities for why you are getting the wrong address.
1. The alerts were created by an admin for the external users while the
admin was logged in on the internal address. The easiest way to do this is to
delete and re-create the alerts while logged in through the external address.
2. Your external address isn't actually an AAM, but something being
handled by a proxy server or ISA server. I don't know enough about your design,
but this could be an issue.
#2 is possible but a long shot. #1 is more likely. I would not try to hard
code the AlertTemplates.xml file to fix this. You should make sure the alerts
were created the right way and re-create them if necessary. As I remember there
is also an STSADM command that will do a bulk change of the alert address, but I
don't think this will work in your environment if you have regular internal
alerts that need to stay internal.