Anything we can say at this point is purely speculation, but based upon the information provided, I suspect the most likely explanation is inadvertent error, not malicious hacking. Hacking is certainly possible, but it's not the first explanation I'd leap to.
For instance, maybe Steve inadvertently hooked up his email address to Dave's phone, or maybe Steve inadvertently typed his email password into Dave's phone while testing and the phone helpfully remembered it, or maybe there was some configuration error in setting up Dave's email on the Outlook server.
I definitely would not accuse Dave of hacking Steve's email based just upon the information provided here. I would accuse Dave of poor judgement and poor ethics in forwarding Steve's emails to others and continuing to access Steve's email once Dave saw that he had access to Steve's email.
Update: Here are some additional suggestions on steps you could take to try to assess fault.
First, contact HR (and Security, if you have a Security department) immediately. They should run the show.
Then, I would suggest you secure any logs from the Outlook Exchange you have, and analyzing them.
Third, I recommend that someone interview Dave and Steve to get their story. For instance, I'd try to nail down the exact timing. If Exchange keeps logs of when the email was accessed, you could then compare the timing and their stories against the timestamps in the Exchange logs. I'd also ask Dave what he did to his phone and how he accessed Steve's emails. I would ask Steve whether there is any chance that he might have entered his password into Dave's phone, even temporarily. I'd also interview Steve to see if he made any configuration changes to Exchange that might have given Dave access to his email. And, I'd try to assess whether Steve has any motive to try to spin things or not (mutual dislike? bad blood?). You probably want to have someone else (HR?) doing the interviewing.
Fourth, I recommend that you confiscate Dave's phone for examination without further delay. If it was a mistake, either Dave's phone may still have access to Steve's email, or Dave may be able to give some story about what happened that might explain why his phone no longer has access to Steve's email.
After you have assessed all the information available to you, if you're still not sure what happened, you could always consider trying an old interviewer's trick. Have HR sit Dave down and say "Look, Dave, this is a very serious situation. We confiscated your phone, we analyzed the logs on your phone and on the Exchange server, and we know just about everything about what happened. The only thing we don't know is whether your actions were premeditated, or whether they were a spur-of-the-moment instance of poor judgement. If your actions were premeditated, this a severe offense, and I may be forced to fire you. On the other hand, if it was not pre-meditated, then that's still not good, but at least it would give me a basis for arguing on your behalf with the CEO. So, if it was not premeditated, and if you are prepared to write out a full and complete confession right now and express remorse, I am prepared to argue for leniency in your case. But don't try and snow me: if your confession differs in even one iota from the log information we already have, deal's off, and I'm going to be pissed. So, what do you say, Dave?" No guarantees that it'll work, though.
