This vulnerability exists only for users who read Exchange 5.5 mail in IE, not for those who read mail in any other browser or in an Outlook client.
An attacker can't exploit this vulnerability to perform actions to any other mailboxes, the Exchange server, or the user's local machine.