You should check your firewall rules on the XMBC Pi. The reason is that, out of security cocerns, some preconfigured boxes bar all connections originating from outside one's LAN.
The command to do this is
iptables -t filter -L -n -v
and likewise for the other tables, nat and mangle. If you can act on these rules, then this is the simplest solution.
Alternatively, if your router runs software like dd-wrt, OpenWrt, Tomato, and so on, then the following rule on the router
iptables -t nat -A POSTROUTING -o LAN_IFACE -s ! 192.168.0.0/24 -d 192.168.0.15 -p tcp --dport 22 -j MASQUERADE
This assumes that your home net is 192.168.0.0/24, that the recalcitrant Pi is 192.168.0.15, and that the router's LAN interface is called LAN_IFACE. The rule simply rewrites the packet's origin as coming from the router itself (192.168.0.1 under the above assumptions), thus tricking the XMBC to think that the connections are initiated locallly, rather than remotely.
Lastly, if your router does not allow the above, if you have some other Linux machine (like, I presume, the first Pi), you can
port forward the connections for the Pi2 to some high-numbered ports of Pi1
redirect these packets, after masquerading, to Pi2 and its proper port.
This time, per port, you need two commands: let us again consider ssh, and let us say that the router has port-forwarded ssh connections for Pi2 to Pi1's 51111 port (192.168.0.10:51111). Then:
iptables -A PREROUTING -t nat -i eth0 -p tcp --dport 51111 -j DNAT --to 192.168.0.15:22
iptables -A FORWARD -p tcp -d 192.168.0.15 --dport 22 -j ACCEPT
Just make sure you have allowed forwarding on Pi1,