What's i'd say as well is that the exchange admin owns the data - therefore if he wants to wipe it, demand a certain type of password, etc, then he's free to do so. 'my realm, my rules'