Might this be related to a problem we have with OWA post (and possibly pre) SP3?
We want to completly disable auto replies sent to external users being configured by users from any client. However, even if the mailbox has the value: -ExternalOofOptions: InternalOnly set a user is able to login to the light version of OWA and is able to see the section for auto replies sent to external senders. If that same user logs into the Premium version they do not see the auto replies to external senders. What's more, when configured and enabled to sent auto replies to external senders in the light version the auto replies are actually sent out to the external sender. A bug perhaps?