Imperonsation/Delegation

Some of our services have been designed to impersonate the calling user, i.e. 
<Impersonate=”true”/>. This does not seem to agree with BizTalk as we are 
unable to pass the calling clients credentials through i.e. Web 
Service(Generated by BizTalk) => BizTalk => Web Service. The final service 
always runs under the BizTalk host account. 

We are questioning if BizTalk can achieve this out of the box or if this 
requires the development of a custom adapter?

We are also questioning if this Impersonation/Delegation style of developing 
services suits a BizTalk solution, or whether we should alter our services 
security to a Trusted Subsystem design?