This looks like an issue with the client, so switching to a different server stack (like WSIT) won't do much good.
I'd start by using a tool like SOAPUI or tcpmon to examine what
does get sent to the service. Does the
SOAP include the same (or functionally equivalent) WS-Security information as the one sent by the Java client? That should provide a starting point for further investigation.