I am not hundred percent sure, but this seems to be “by design” of processing packets in order to identify related applications. Simply just one port from communication is preserved and its either the one (from source port and destination port) that is monitored or the smaller one if both are monitored. So in your case, there will be very probably smaller monitored ports on the other end of communication (smtp, http by owa or plenty others – http://msdn.microsoft.com/en-us/library/cc463889(v=EXCHG.80).aspx), which caused the ports on Exchange site to be zeroed in our data – so unluckily you cannot find these records by these ports any more.
In case your exchange server(s) has dedicated IP and there is not any other online application running on this box, you would be probably able to see expected results by reviewing Conversations for specific endpoint (which is your exchange server box).
Let us know if this does not help to handle your problem.