Now that's just silly. OWA uses SSL. Passwords are sent encrypted in the secure session. DoD's beef with OWA is that it doesn't support two-factor authentication. By Executive Order, all web-based DoD systems have to support CAC cards.
The older version doesn't. I'm not certain which version that was in use at the time, but I have seen this for myself.
Refreshing to see someone else who actually knows what they're talking about.