Exchange 2003 Email Security

Hope this not as stupid a question as I think it is, but…
Currently, any user that knows the name of the exchange server and login name can set up any email account within the organization by setting up another profile, if they wanted to. I would like to close this door. Where are the settings to prevent this from possibly happening?