What we did was created a receive connector on our server running the hub
transport role, and configured it to accept un-authenticated requests only from
the MOSS server. Here's the powershell script to make it happen:
New-ReceiveConnector -Name "MOSS_Server" -Server HUB_TPT_SERVER -Bindings
0.0.0.0:25 -RemoteIPRanges w.x.y.z -AuthMechanism TLS,ExternalAuthoritative
-PermissionGroup ExchangeServers
Where HUB_TPT_SERVER is the hostname of your hub transport servers, and w.x.y.z
is the IP address of your MOSS server.