The only way I've been able to find SMTP addresses configured in notification devices is to do a bulk export of all mailboxes to a csv file using the bulk admin tool.  It's helpful for finding other info that's not directly searchable from the admin ...

Thanks for the post - setting duplex streaming to True as indicated above fixed the problem for me as well.  Never had an issue with the many 2900's we have in use but first 4331 deployed this came up.