Here is the info on the LDAP request from step 5 and some more info as well.
Step through an Explicit Authenticated Private Information Store request
-Exprox requests the path for the incoming URL request, for instance the client request is http://mail.microsoft.com/exchange/username , the resulting path replied via IIS would be something like m:redmond.microsoft.comMBX/username
-Since this is an EXPLICIT login (/exchange/username) exprox requests information on this user from DsAccess based on a proxy address it creates from the username given in the URL and the SMTP domain that is used in the Local path information returned by IIS (Note: This local path is constructed using the SMTP domain selected upon creation of the virtual directory for mailboxes via the ESM when typing in “insertdomainnamehere.com” mailboxes for:).
-Once the proxy address is constructed, the LDAP query issued is a search filter for proxyAddresses=SMTP:username@smtpdomain.com and objectclass=user, the requested attribute for the mailbox is the msExchHomeMDB attribute to determine what private information store database the user is on.