Mail clients will regularly connect to Exchange's autodiscover to ensure that the connection to Exchange is correctly configured. This typically happens in the background, but some mail clients (seems to be mostly Outlook 2010 and 2011) occasionally pop up something like the following:
It's unclear why this happens and is still being investigated, since the autodiscover server has a proper certificate.
Regardless, users should be told to click "Allow" as long as the autodiscover address is correct. Clicking deny will generate the same popup over and over and won't allow the Exchange account to connect.