Based upon Mail being able to send out of my iCloud account, I think your #3 is close to the mark.
It just seems strange that Connection Doctor can't correctly report on the iCloud SMTP query, if it's timing out, when all the other queries quickly complete and verify satisfactorily.
