SMTP AUTH is great. Configuring your MTA to support this ensures that all your users can use the mail server when they're out on the road. But unless you ensure that the session is encrypted, your users' credentials may find themselves in the hands of spammers or worse (ensure that your server's certificate is trusted to prevent man-in-the-middle attacks!). Configure Exim so that it supports
TLS, then have a look
here for a quick description on how to configure SMTP AUTH securely.