By default email will be stored in the phone's internal memory, not on the SD card. (Though you can 'move' the app to SD storage, so it is possible that the SD card gets used). As others have said, once your mail is on the SD card, there is no protection as the SD card is removable (since the data is unencrypted).
For mail that is stored in the phone's built-in memory, an attacker would have to unlock the phone to get the data. Either directly through the mail app once unlocked, or to put the phone into "USB disk mode" to read the phone's state from a USB-attached computer. (A really sophisticated attacker could probably disassemble your phone and wire the flash to a custom reader, by passing the phone lock and read your unencrypted emails off of the flash.)
Note that the Exchange connection allows the Exchange server to send a command to wipe your device. (I believe this is contingent on some setup by the Exchange admin.) In the web UI for my Exchange email server, there is an option to list authorized devices and to wipe them remotely. Of course, the phone needs to be on a network to receive this command, so an attacker could delay this command by preventing the phone from using its networks.