We tried doing a similar thing earlier this year. We wanted to develop a SharePoint App Part that showed a Live Tile with the current unread mail count. I opened a topic on MSDN Forums to discuss this:
You say you want to go auto-hosted. I think that might work. I think the best way in that scenario would be to use the service account approach. Your code should verify the user and use the service account to impersonate and get the info from Exchange. All code runs server-side, so less of a security risk. However, getting your Exchange admins to create such an account might be problematic. Being able to impersonate any user in Exchange is a very powerfull thing. Most admins I know will not like such a thing.