I'm partial to hosting my own email for organizations of that size. I like to outsource the spam filtering (often to Google's Postini service) because it makes a lot of sense from a cost perspective, but I feel better about having all the email stored on a server that, ultimately, I have control and responsibility over.
At $2,500 / year for the "annual plan" from Google for 50 users I think there's a strong cost argument to be made for hosting yourself, personally. (Yeah, yeah-- we can get into CAPEX versus OPEX arguments about this. Tax-dodge issues aside, the amortized cost of a $2,000 server computer and $2,000 of software licenses over 5 years is cheaper, per month, than $2,500 / year for hosting at Google over the same time period...)
Exchange 2003, for that small number of users, doesn't need a lot of "care and feeding" if it's administered by a competent administrator. I don't consider "ongoing support cost" to be a major differentiating factor between the Google solution and Exchange for that size of an organization. (In fact, unless you go the route of setting up Google Apps Directory Sync and federating your authentication with Google I might argue that provisioning new users, groups, and contacts in Exchange is easier than w/ Google's service.)
You get all the functionality of Outlook, which is still lacking in Google's offering. Users can access each other's calendars and you can have public folder "resource" calendars (albeit automated scheduling of these resources in E2K3 is lacking).
I'd never have users' primary email store be a local hard disk drive. For an organization that small (with, I assume, a fairly small throughput of messages) you could easily get away with a small RAID-5, RAID-6, RAID-1 array to store the email. Put the database transaction logs on a separate RAID-1 or RAID-10 spindle and you'll get very reasonable performance.
Filter the email with a service like Google Postini and you don't have to open up TCP port 25 to the rest of the world (only to the filtering company's servers). Keep the server computer updated with OS and Exchange patches, get a third-party certificate for Outlook Web Access, use SSL, and require your users to have "strong" passwords (bad passwords are a risk with both Google and Exchange) and you're minimizing your security risk. There are no public unpatched remote code execution in Exchange 2003 at present. There may be, someday, and when the product goes "end-of-life" with Microsoft there won't be any more patches.
If you've got a paid-for copy of Exchange 2003 and the necessary CALs today go ahead and use it. It will work and it's not an unreasonable solution. If you're buying something new get Exchange 2010.