Some parts to check would be:
Security trust of the form - is it only set at domain level or full trust?
Does the form have any data connections? If so, have they been converted to an .udcx file?
I've had issues from www when data connections aren't converted.