This is a major unresolved issue. Not only is Exchange, the service, a vector for attack, but AD-related permissions granted to the Exchange computer account and admins can leave your entire directory vulnerable.