http://searchexchange.techtarget.com/tip/0,289483,sid43_gci1099509,00.html"In most situations, clients need three different licenses: "
This is consistent with all the advise I have seen everywhere. However, for final licensing arbitration, please contact your local Microsoft representative. "I heard it on EE" is not going to stack up in the face of licensing audits.
Each of Windows/Exchange will support per-device, per-user CALs, so mix and match what makes the most sense for you. Even if the users never log on to the Windows 2008 server and are accessing Exchange via OWA, you still need a CAL for the mere fact they are accessing (authenticating against) Active Directory on the Windows 2008 server.