There are two ways of allowing access to mailboxes in the Exchange world:
via the AD Computers and Users console (which should hopefully be quite secure) or via Outlook folder sharing.
Maybe somebody was experimenting with their Outlook configuration and left themselves wide open to attack.
If more than one mailbox has ben compromised then it might a problem higher up the geek chain