A blog post was published by Dirk-jan Mollema titled "Abusing Exchange: One API call away from Domain Admin " (...