I've been spending quite a lot of time looking at mail routing options using a shared namespace - not something most people tend to do, however quite important in this case J
I found some information at MSExchange.org that helps clarify the routing mechanism that takes place in Exchange 2007, and when to use the different types of relay options available.
In this case we wanted to be able to route mail from a hosted service to an IMAP-based platform while in co-existence mode. This would use the "mailhost" attribute in the local directory to re-route the message to AD, and the Hub Transport servers would then route the message to the local message stores. Effectively users who have not been migrated yet would be in the AD as mail-enabled users, but with the "TargetAddress" set to match the SMTP address - this fools the server into thinking that the user is in fact, a contact! The message would then be routed via relay to the IMAP servers, therefore preventing the need to create contact placeholders for the users prior to migration. It also means that changing from a contact to a mail-enabled user is a far less exhauting task...
I also managed to dig out some information on categorisation, which can be found here.