Interesting that Microsoft assumes that no one is crazy enough to connect an Exchange server directly to the Internet without a firewall - To protect against attacks from the Internet, port 25 should be blocked on the firewall
At heise online news there's the original article.