Thanks to Zoredache's helpful comment above, I've found an alternative. DavMail can experimentally act as an EWS client, and then re-serve email via POP or IMAP (using SSL, optionally).
Here's what I ended up doing, start to finish:
- Find your Exchange server's EWS endpoint. This may be as simple as https://your.server.com/EWS/Services.wsdl, but for me it was on a different domain. I referred to the Macintosh documentation that my provider offers, because I guess both Mail and Entourage use EWS to communicate with Exchange. When you find the right endpoint, you should have a standard HTTP authorization prompt and, after you authenticate, a SOAP WSDL.
- Install Java on my server.
- Follow the DavMail wiki's instructions on manually setting up DavMail as a server. This was helpful for me because my server doesn't run X and the DavMail .deb comes with some GUI components.
- Close the ports you don't need by removing the port values in the properties file.
- Follow the DavMail wiki's instructions on using SSL with DavMail.
Voilà! Thanks again, Zoredache!