From how you're describing it, this "firewall" looks a lot more like a reverse proxy.
NAT is usually applied to outgoing connections, not to incoming ones. When a computer in the private network opens a connection to the outside world, the remote server sees the connection as coming from the firewall's public IP address; but when a remote computer opens a connection to one of your internal servers (through a port forwarding on the firewall), it sees the connection as coming from the actual public IP address it's originating from. What you're describing is the typical behaviour of a reverse proxy, not of a NAT firewall.
Are you sure there's not any reverse proxy (like SQUID) running on that firewall and intercepting incoming HTTP(S) connections? SQUID can also act as a transparent proxy, so it could be there without you having any knowledge of that. This would be also the standard behaviour of ISA Server when you publish an internal web site: even if you think you're just doing a port forwarding, you're actually reverse-proxying your web server.
root
access, you can see the resulting rules withiptables -L nat -n -v
.