Rupp, you might be less concerned about secuirty if the entire thing is behind a firewall and isn't being made available across the Internet. Then again, sometimes you want the security from the other employees...
I have successfully installed and used phpBB and similar varieties on IIS 5.0 with PHP and a MySQL back end. The forum software and MySQL are both inexpensive or free, and can co-exist on an IIS server mostly without problems. Once in a while you run into slight differences with support libraries that may make some functions work differently, but the authors usually make those differences pretty transparent with special platform-specific files that you load depending on your platform.
Typically the database resides on the machine that hosts it - in this case the web server - so that all info is local and network permissions aren't needed (which keeps from exposing the data to possible interception on the network, etc.). Some will use ODBC connections to the back end db, and will work with Access, but be aware that Access is not a multiuser db and multiple copies of a forum package running from multiple simultaneous sessions could cause it problems. Best to stick with some form of SQL.
The Exchange public folders is also an excellent idea, and can even be tied to the NNTP news protocol running on Exchange. It's all included in Exchange.