Guys,
I've just fixed my service not starting problem as above and noticed that IP addresses keep getting added to the Exchange IP blocklist. However, they only appear in the list for a few minutes, not the full 24 hours. My theory at the moment is that TMG detects the entry in the block list, reapplies the configuration, hence the event log messages, and in doing so clears the block list.