Did the message maybe get dehydrated? You can check by running a query for “All Service Instances”, rather than just for suspended instances. I find this is the easiest way to look for messages stuck in BizTalk. This way, in addition to suspended messages, you will be able to see the dehydrated messages, ready to run messages, etc. Also, you might want to view the message flow in HAT. That will show you the chain of receive ports, orchestrations, and send ports that processed the message. This could be a firewall issue, but there will be an error or a stuck message somewhere.
Also, are you using the MSMQ adapter? You might want to consider using the WCF-NetMSMQ adapter instead, so you can leverage the WCF tracing stack to help debug your issue.