DHCP NAK sent from server

I have a relatively simple question about the way the Windows 2003 Server
DHCP server sends NAKs back to clients.

Imagine a network where the DHCP server is on one broadcast domain and the
clients are on another, with a relay agent in between.

Client broadcasts discover, relay agent forwards to server. Server responds
with an offer to the relay agent, which in turn broadcasts on the client's
network. Client sends request, server ACKs (both via relay agent), as
expected.

When renewal time comes up, assume the lease is no longer valid (even though
the lease was originally assigned with a lease time of twice the current time
(renewal time T1) and should still be valid...). So, in order to request the
renewal, the client sends a request directly to the DHCP server without the
use of a relay.

When the server attempts to send a NAK back to the client, it sends it to
255.255.255.255 and it never reaches the client. Since the relay was not
involved in the request, the giaddr is set to 0.0.0.0.

This does seem to be the expected behaviour, after all, why should a server
NAK a lease that the client thinks is still good ... regardless, I am trying
to simulate an environment where this occurs and cannot be changed, and am
having one heck of a time.

Any suggestions/ideas on how to get the NAK to actually get back to the
client?

Thanks!