Hi John,
When your mailbox is on Exchange 2007 Mailbox Server you are doing CAS-CAS Proxying and there is not need to touch the permissions on the legacy virtual directory /Exchange on the CAS.
However if your mailbox is on a Exchange 2003 BE server, then you are proxying from CAS to Exch2K3 BE, and it only works if Integrated Windows Authentication is enabled on the Exch2K3 BE server /Exchange virtual diretory.
Proxying is not supported between virtual directories that use Basic authentication. For client communications to be proxied between virtual directories on different servers, the virtual directories must use Integrated Windows authentication.
http://technet.microsoft.com/en-us/library/bb310763.aspx
Vandy Rodrigues