I've seen this before, In fact, i just faced it the other day. It took a little bit of head scratching to get it to work. It has to do with IIS directory permissions. The graphics all come from the "exchweb" directory. The Authentication on all exchange directories should look like this:
Exchweb folder-
Enable anonymous: Checked
Integrated Windows Authentication: Checked
Basic: checked, say yes to message
Default domain: YOUR NETBIOS DOMAIN NAME (i like doing this it makes my users less confused, it assumes domain name and the user just types their user name)
------------------------------------------
Exadmin folder-
Only Integrated Windows Authentication, no other authentication
------------------------------------------
Exchange folder (the make or break you OWA folder)
On Virtual directory tab -
local path="\\.\BackOfficeStorage\primary mail domain\MBX"
all check boxes checked, "Scriptsource, read, write, directory browsing, log, index"
No Application defined
------------------------------------------
On Authentication-
No anonymous
Integrated Windows:Checked
Basic:checked, click yes to message
Default domain, Same as above
------------------------------------------
Also, i set my "Public" share the same as the exchweb folder. It puts a little more security in
------------------------------------------
note, dont neccesarily let the settings cascade over other folders that have defined their own permissions. Sometimes you can mess things up doing this.