I wasn't so much asking about the trunking, but that information is helpful as well.
Again, I've only ever done UCA against a 3300, so my understanding of the underlying connections needed maybe wrong.
The UCA client uses tcp port 5060 (SIP) for call setup, among the various other ports it uses for client authentication, directory sync, etc.
You state that your 5000 is in your DMZ. Is this DMZ created by your internet firewall or is it a physical DMZ? Because of your statement "it sits in our DMZ for the purposes of Admin" and that you say all other UCA functions work, I'm thinking this is a firewall based DMZ.
What I'm getting at is because SIP is required for call setup on the UCA client, if your firewall is say a Cisco ASA or a SonicWall, it maybe a SIP aware firewall and not allowing inbound SIP traffic to get to your 5000. I personally have seen an option within a SonicWall that prevented SIP traffic from being routed to a SIP-Edgewater-Router sitting in its DMZ. Once we turned that off, we were able to get SIP voice traffic through it.
A Teleworker/MBG server comes with a utility to test connections from a remote location to the MBG. I doubt it would work correctly against a DMZ'd 5000, but it does check the UCA and SIP ports. If you would like to try this, let me know via private message and I can email you a copy of the program. It maybe able to show you if the 5060 port is passing through to your 5000.