hi there,
to be quite honest i don't see the logic in how you have laid out your network... why didn't you use the trusted zone for your workstations, the untrusted zone to go off to your internet pipe, and the dmz for your servers? or alternatively create a new zone/interface for your servers leaving your dmz for anything you wanted to surface out to the internet?
that aside... in your current setup, by default your trust interface will be in nat mode and your untrust interface will be route mode. this means that everything initated from the trusted zone to your untrusted zone (so in your case from your servers to your workstations) will be hidden behind the egress (untrusted zone) ip address. that might not be playing nice with your environment. see what happens if you try putting both your interfaces in route mode so everything appears from their real ip addresses.
also, confirm you have a policy both from trust > untrust for the services you need, and also an additional matching policy from untrust > trust. not sure there is a huge amount of point in having such a nice device in your lan if you are just going to utilise any/any/any policies!
hope this helps! 
p.s. how comes you are using public ip addressing for all your internal lan's?
One off topic suggestion. If your IP scheme really is 150.x.x.x., 181.x.x.x, etc. then reconsider the adressing scheme today.
If it does not trouble you today, it will in the near future. Use private space addresses or real ip addresses you own.
If you have FAT client Outlook/Exchange connections, then firewalling this will be a hard task. The client server connection
is using RPC and highports (>1024) to connect. You would have to open these ports to the Exhange server(s).
Do the Exchange connections drop after a specific amount of time; say 30 minutes? You could solve this by enabling some sort
of Keepalive on the Client - Server connection. I know that some MS (and other) protocols pretend to think that TCP sessions last
forever.
