Played around and added the site as a trusted web site, disabled a bunch of stuff and we could log in. The website is crippled after login. Key components aren't working. IE8 is fine. Safari is fine. Android, Chrome and absolutely everything else works.
On top of that, it took me over an hour to download and install IE9 for testing. I tell you Microsoft is crap and a dead man walking.
I will let you know the fix when I find it.
Update: See blog entry above on Domain Forwarding with Masking.