It worked the other way until I applied the 8.6.6257 update in April.  So what you are saying is that even though it is the same single person/user, if they want to organize their email depending on which mailbox it goes to, they have to have multiple logins just to be able to manage their emails?  This is counterintuitive for 'firewall' mode.  Is there any way to revert to the previous method of association?