it's a bit vague here, but I guess what you are saying is the mails sent from webservice.xxxx.com to mail.xxxx.com where both are the same domain are not getting received at mail.xxxx.com (ironport ESA).
Question:
1. What did the ESA mail log say when tracing the mails sent from webservice?
2. Is there any anti-spoofing mechanism (filters) that blocks or drops the mails received from outside but having the same domain name currently activated?
Hopefully having the answer from the question above could be a good point to start the investigation.
Regards,
Donny