I ran into this same issue using VS2010. The solution is to create a custom client using WSE security without encryption. I found information
http://webservices20.blogspot.co.il/2008/11/introducing-wcf-clearusernamebinding.html
The web method creates a new request and the custom client, and then calls that request using the client:
//Create ...