Apparently, settings described in my previous post isn't good enough to make it work, it wasn't quite right indeed. There are a lot more stuff needed to be figured out. Google isn't much helpful in this case, which is a little bit surprise, maybe this case is just so rare.
To recap what I need, I have a simple impersonate set to true web form that collects information and email them into a distribution group that receives email from Authenticated User Only in Exchange. It might be easy when impersonate is set to false because then you can simply set up the user info and get authenticated in Exchange when sending the email. I had it work without any problem in ASP.Net 1.1 but not so easy in 2.0.
It turned out the only way of doing so is:
1. hosting the form on the same server as Exchange,
2. set the deliveryMethod to "PickupDirectoryFromIis" in web.config file.
And then, the permission to do the PickupDirectoryFromIis started confusing me as I have no idea what permission should be granted. For now, I just put whoever needs to use the form to local administrator group, which appears working fine. But that can't be permanent, only temporarily.
Mission still has yet accomplished.