Windows/AD/Exchange does not have to be a security nightmare - provided you patch, configure and administer the boxes properly (and that advice goes for ALL systems). You would benefit from checking that you have a secure baseline build for your Win2k/2k3 boxes (maybe use the NSA SNAC hardening guides?) and a proper patching mechanism in place (e.g. SUS or SMS). Configuration change management and proper documentation should be order of the day across ALL corporate systems.

If you're sending/receiving mails to/from outside, you should be running an SMTP proxy in a firewalled DMZ - this allows you to trap mails and scan them for the nasties, before they reach your exchange server. Again, OpenBSD running Postfix, ClamAV and SpamAssasin would be well placed here. Same goes for your web traffic - setup Squid on another box in the DMZ and inspect all traffic - ban your prohibited file types there. Log mails/web traffic which violates policy and set the systems to mail your admin team.

The diagram I attached above was how I saw what you described. It isn't necessarily the best way to go. Personally, I would remove the "hardware firewall" and let the OpenBSD boxes be your firewalls/routers to the outside world, then configure some DMZs for the semi-public services such as web servers and mail/web proxies. If you're on dialup, attach a modem to each OpenBSD firewall yourself and let it handle the dialup needs during failover. If you have DSL/leased line, speak to your ISP and see if they can supply you with some sort of redundancy at that point (maybe even an ISDN backup for your fixed link) with an upgraded device. Also consider two separate ISPs to provide services, in case one goes belly up.

Nick