We have a new dealer who uses Outlook Express to manage several different
email acccounts he has. Normally dealers connect to our systems using and
RDP connection and run a terminal server session where they then run our
Outlook 2002 client to access their email locally on the exchange server.
However, this dealer has just asked if he can access his email account on
our Exchange 2000 server using his Outlook Express client with an IMAP
configuration instead of having to log onto a terminal server session to do
so.

I am pretty sure this is do-able without any problems, but my question is
regarding security. Is this something that I should not worry about too much
or are there any major security ramifications of allowing this type of a
direct connection to our server? There will not be a VPN connection or an
SSL involved either... This user will just have an internet connection
through his provider and then connect to our server - no VPN/SSL connection
(not sure if either of these should be used for this type of thing or
not...) Just how secure is a direct IMAP connection from an Outlook Express
client to an Exchange 2000 server across the internet?

What else should I be thinking about?

Thanks, Brad