Allow External Access is for the portion of SData that's installed on the IIS box related to BOI access to \mas90. Since you've covered that, another place to look is in the Sage SData demo. They have a globalSetting.js java script where they defined global variables such as the company code (see below) which is then used in other java scripts (which is called by the HTML). I presume these scripts would sit on the IIS box of the web root folder for the website specified at the time SData Adapter was installed.
IOW, your SData developer may have some java script or similar holding a global variable for the company code and presumably located on the IIS box. If you can find it then try editing it. You may then need to ""restart the website"" in IIS"".
// globalSettings.js
// Some global variables
var gAuthString = 'sdata:pass';
var gCompany = 'ABC';
var gFocusedId;