Remediation will not be simple — it will effectively require backing up data, re-imaging the Exchange server, scrubbing the backup of any accounts which should not be present, resetting all passwords and secrets and restoring the remaining backup data.