So it turns out that Outlook 2010 SP1 added a fairly useful feature. When you grant Full Access permissions to a mailbox on Exchange, the Outlook client for that user automatically adds the mailbox for them. (see http://www.stevieg.org/2010/08/auto-mapping-shared-mailboxes-in-exchange-2010-sp1-with-outlook-2010/)
The problem comes on removing permissions – the mailbox link remains and CANNOT be deleted from the Outlook list in the application.
The fix is to go into ADSIEdit, Default naming context, and drill down to the mailbox account you wish to be removed from, and look for the “MSExchDelegateListLink” attribute and remove the entry you are revoking permissions from in that list. The next time you start Outlook 2010, the ghost “additional” mailbox should disappear after a few minutes. (up to 15 depending on Active Directory replication between DCs).
Thanks Microsoft – when can we have this fixed please?