If you remove the BESAdmin account's Exchange permissions then the BES server will not be able to access the hidden folder/files created in each BlackBerry user's mailbox and the BES system will not work. A read-only copy of each user's encryption key, for example, are stored in the Exchange mailboxes.

When you are installing service packs and hotfixes you should be logged using the BESAdmin account.