I believe your issue is caused by using IIS admin tools to administer the ECP virtual directory instead of Exchange Management Console.  The auth settings for NTLM should look like this:

InternalAuthenticationMethods : {Ntlm, WindowsIntegrated}
BasicAuthentication           : False
WindowsAuthentication         : True
DigestAuthentication          : False
FormsAuthentication           : False
LiveIdAuthentication          : False

Yours look like this:

InternalAuthenticationMethods : {Basic, Fba}
BasicAuthentication           : False
WindowsAuthentication         : True
DigestAuthentication          : False
FormsAuthentication           : False
LiveIdAuthentication          : False

While the flag for WindowsAuthentication says $true, the InternalAuthenticationMethods property directs IIS to apply FBA.  The fix would be to go into Exchange Management Console and set Windows Auth setting there.  If it's already set, change it to FBA first, apply, then back to Windows and apply again.  When you run Get-ECPVirtualDirectory | fl *Authentication*  on cmdline you should get settings similar to my first example.