Hi James,
It sounds to me as if the address that is being used as the source of the tunnel at the spoke end might be getting NAT'd and is therefore not reachable. What output do you get from deb ip nhrp and deb tunnel on the hub? Also, if you could post your configs, that would help
I assume there's not another device before the core that could be doing the NAT as well, rather than doing it on the hub router?
Cheers,
Neil