It is no good idea to allow direct access to Exchange servers from the Internet without additional protection. Using username/password to access mailboxes is certainly not enough! In the past we have seen many attacks even using zero day exploits….