nbtstat -C gives me strange IPs...normal?

LMHOSTS file is used to Locate Multiple Preferred Logon Servers
http://support.microsoft.com/default.aspx?scid=kb;EN-US;192064

Here is what I know on the netbios name cache you are looking at.
When a machine makes an outbound or receives an inbound netbios connection, both machines would have an entry in its netbios name cache. The Life [sec] column counts down from 600 seconds from the connection taking place. So, in your posted example, your mail server received a netbios connection either from or to 218.106.114.212     2 minutes before you ran the nbtstat -c command.
Now, this also includes not only a drive mapping/accessing a shared folder, but even doing a netbios name lookup. So, from a port standpoint, this includes TCP port 139 and/or 445, AND UDP port 137 and 138. Those are all of the netbios ports (well, technically, TCP port 445 is SMB, but it works the same).
So, that is the deal.
Can you have a connection in the netbios cache that resolves to a machine outside of your LAN? Yes. Sure. If you do a netbios connection on an outside machine, or if you let the outside machine look at your server, then that's gonna record in the netbios cache.
Now, to think about exactly why you have these two entries in your Exchange server. I have to ask if this Exchange server is properly firewalled from the Internet? Do you let any Internet-based machines connect to the Exchange server on the ports I listed above? If so, then that would explain it.
Now, I don't run Exchange (I'm in a Domino shop) so I don't know how Exchnage works exactly, but I do know that Windows can act strange at times. I know that sometimes an IIS web server will do a reverse netbios lookup on clients that connect to it via HTTP. I've seen it myself. Weird, yes, but it does it. Also, 3rd party apps on a Windows machine also indirectly makes Windows act that way. For example, a Winamp Streaming server, when you first connect to it, will cause the Windows machine it is running on to do a netbios name lookup. I've seen that myself also.
So, maybe that is all that is going on. Maybe your Exchange server is either sending mail to those 2 IP addresses, or receiving mail from them, and in the process it is doing the netbios name lookups against them AND they are responding. Or, like I said before, maybe your Exchange server is not properly firewalled and those IP addresses are checking your server out!
Anyway, that's what I see here.

I blocked those 2 strange IPs at my firewall.
My mail server is actually trying to send things on port 25 at those 2 IPs.
If you look at http://www1.dshield.org/warning_explanation.php?fip=218.106.114.212&Submit=Submit , you'll see that 218.106.114.212 is an attacker.
I've had about 800 outgoing requests to those 2 IPs in the past 2 days.

All NetBios Ports are blocked at my firewall. Actually, only the ports required for regular services all allowed out or in. Everything else is denied by default. I don't use any streaming or particular program. Exchange only require port 25 and 110 for our use.

This seems to be a Spam or something problem. I don't know how, but my server is trying to initiate an outbound connection to those 2 IPs.