I have recently migrated a client to Exchange 2010 from Postfix/Dovecot. Under the old setup a user with a BlackBerry would need to enter their username/password, which is then 'known' to a 3rd party (ie BlackBerry). I was always uncomfortable with this but at least if the password fell into the wrong hands, they would only have access to a single email account and no other resources.
Now, a user who has access to our RDS Gateway also has a BlackBerry, which requires her domain username and password to pass through the hands of a 3rd party. This makes me more uncomfortable than I was before.
What is the easiest way round this? Ideally I'd like users to have a second password that only works for IMAP.