Permissions in Outlook 2003 with Exchange 5.5 Server

I haven't been able to figure out how to keep employees from attaching
(adding) other employees mailboxes to their outlook. They do this through
Tools/EMail Accounts/View or change existing email accounts/Change/More
Settings/Advanced, etc...
One employee in particular has added the CEO and another employee's mailbox
to her Outlook. The thing is..I'm not sure if she can actually see any of
the other employees mail. All I know is that the event log on the server
triggers an event when another person's email has been logged into by someone
else.
What kind of permissions on the mailboxes should be set to prevent someone
from accessing someone else's mail from another computer? Or is it set that
way by default?
They seem to default to name: "default", Permission
Level: "none".
In other words, unless you add permissions for someone else to access
someone's mailbox, is it secure?

Thanks,

Robert