Using ActiveSync to access Exchange would probably be the best way to pull it off (though there are probably patent-related concerns). A lot of Exchange admins aren't going to like opening up IMAP, but nearly every Exchange installation today has ActiveSync enabled and exposed to the Internet.