You might give PhoneFactor a go. They have a special agent for OWA which you install directly on the Exchange Server. It's free and it takes about half an hour to install. It relies on a wireless phone or wireline phone to provide the 2-factor Authentication.