The msExchStorageGroup schema class added during Exchange installation can be used to create almost any AD object including users, groups or domain trusts leading to elevation of privilege.
627232e16239714ec375a9cfcdcb5ae5ed42b0f516a9d4728d978cfb3abf4962