Of course, you'd have to do a detailed risk assessment to answer this question, but some points that may reassure you:
- Exchange always encrypts all RPC traffic, client-server and server-server. It relies on the OS for this, so the algorithm varies: I think it's typically RSA or CAST?
- And it always encrypts all internal HTTP traffic with TLS.
- By default, it always attempts to use TLS when talking to external mail hosts (and you can prevent it falling back to plain SMTP on a per-host basis)
- All remote clients connect over HTTPS.
- Exchange has hooks for tight integration to anti-malware, anti-spam, and backup systems, either from MS or other vendors.
- Exchange has tight BES integration for Blackberry; and iPhones use Microsoft ActiveSync for their push email - which was designed for Exchange.
- Exchange has topology options allowing you to put a limited functionality edge server in the DMZ.
- Exchange supports IRM and S/MIME for encrypting/signing individual messages.
- Exchange has pretty comprehensive resiliency/recoverability features
- Exchange has built-in compliance options (e.g. email retention and discovery)
For your specific Outlook question, Outlook has a feature called Outlook Anywhere which wraps it's RPC traffic in HTTPS. It's used automatically when the client detects it is not inside the network.
Exchange doesn't do any authentication itself though - it entirely depends on Active Directory, in fact there isn't really such as thing as an "Exchange account" - so having separate login and email passwords is not trivial. Some people do manage it, I believe, by having a separate AD domain for Exchange, but this means a lot of extra work.