Hacked Mail

From: mark (grocezx7r@yahoo.com)
Date: 09/23/02 

From: "mark" <grocezx7r@yahoo.com>
Date: Mon, 23 Sep 2002 13:05:42 -0700

Someone within the company (we think we know how), got
into and read the mail belonging to someone else. We are a
2000 shop, running exchange 2000. Unfortunantly the VP of
IT told EVERYONE the day it happened that it happened!
This gave the person enough time to cover their tracks.
Any ideas? Where to look, what to look for? Etc?