My colleague Sean Daniel reminded me that in SBS SP1, we've enabled a new feature in Exchange SP1 to reduce the viability of performing a directory harvesting to get usernames on your SBS server. This feature (documented at http://support.microsoft.com/default.aspx?scid=KB;EN-US;842851) allows us to slow the response of the server for every e-mail address request made. This makes it extremely expensive and time-consuming to try every possible username.

The feature is enabled by default in SBS SP1 (coming really soon)