Assuming your saying the browser dialog to enter your credentials is popping up. It sounds like there are some components of the page where the anonymous user (and possibly the user themselves) doesn’t have access to the file the page is trying to display. Sounds like the OWA directory has permissions that are preventing the page from being displayed correctly. One way to see if this is the case is to simply cancel the prompts… this will likely result in broken images or components on the page being displayed. If you see a 403 Forbidden error on the page, this is a sure sign permissions are the problem. IMHO it sounds like the first possibility is the culprit.
Buddyfarr also had some suggestions that may help below here.
are you going straight to the exchange server from your router or do you have a front end server first, then the exchange server. Some info I found on the same issue:
“What you need to know is that a front end server in exchange does not allow windows authentication (commonly known as pass through authentication). You have to set the front end to basic authentication. Then set the back end server to windows authenticaion and basic authentication.”
I hope this helps!. Also I found some references to checking your connection timeout settings for the inbound connections. If he opens the email and then clicks immediately on the attachment and it still asks for the credentials then the connection settings are probably not the problem.